Make it clear that not all <link> elements support SRI (mdn#31333)

* Make it clear that not all <link> elements support SRI The text said that "any <script> or <link> element" could have an integrity value. However, according to the W3C SRI spec, only scripts and stylesheets are supported. Other link elements, e.g. used for icons, are not covered by SRI. * Update files/en-us/web/security/subresource_integrity/index.md --------- Co-authored-by: Hamish Willee <[email protected]>
pepelsbey · Jan 2, 2024 · 864e7a8 · 864e7a8
1 parent d055553
commit 864e7a8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/files/en-us/web/security/subresource_integrity/index.md b/files/en-us/web/security/subresource_integrity/index.md
@@ -21,7 +21,7 @@ Subresource Integrity enables you to mitigate some risks of attacks such as this
 
 ## Using Subresource Integrity
 
-You use the Subresource Integrity feature by specifying a base64-encoded cryptographic hash of a resource (file) you're telling the browser to fetch, in the value of the `integrity` attribute of any {{HTMLElement("script")}} or {{HTMLElement("link")}} element.
+You use the Subresource Integrity feature by specifying a base64-encoded cryptographic hash of a resource (file) you're telling the browser to fetch, in the value of the `integrity` attribute of a {{HTMLElement("script")}} element or a {{HTMLElement("link")}} element with [`rel="stylesheet"`](/en-US/docs/Web/HTML/Attributes/rel#stylesheet), [`rel="preload"`](/en-US/docs/Web/HTML/Attributes/rel/preload), or [`rel="modulepreload"`](/en-US/docs/Web/HTML/Attributes/rel/modulepreload).
 
 An `integrity` value begins with at least one string, with each string including a prefix indicating a particular hash algorithm (currently the allowed prefixes are `sha256`, `sha384`, and `sha512`), followed by a dash, and ending with the actual base64-encoded hash.