From 864e7a830d3f658b4cd87098428097bda5ee5b84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hanno=20B=C3=B6ck?= <990588+hannob@users.noreply.github.com>
Date: Tue, 2 Jan 2024 09:34:12 +0100
Subject: [PATCH] Make it clear that not all <link> elements support SRI
 (#31333)

* Make it clear that not all <link> elements support SRI

The text said that "any <script> or <link> element" could have an
integrity value. However, according to the W3C SRI spec, only
scripts and stylesheets are supported. Other link elements, e.g.
used for icons, are not covered by SRI.

* Update files/en-us/web/security/subresource_integrity/index.md

---------

Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
---
 files/en-us/web/security/subresource_integrity/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/security/subresource_integrity/index.md b/files/en-us/web/security/subresource_integrity/index.md
index 06b4f3ad73b1216..2998bef08cf2aa8 100644
--- a/files/en-us/web/security/subresource_integrity/index.md
+++ b/files/en-us/web/security/subresource_integrity/index.md
@@ -21,7 +21,7 @@ Subresource Integrity enables you to mitigate some risks of attacks such as this
 
 ## Using Subresource Integrity
 
-You use the Subresource Integrity feature by specifying a base64-encoded cryptographic hash of a resource (file) you're telling the browser to fetch, in the value of the `integrity` attribute of any {{HTMLElement("script")}} or {{HTMLElement("link")}} element.
+You use the Subresource Integrity feature by specifying a base64-encoded cryptographic hash of a resource (file) you're telling the browser to fetch, in the value of the `integrity` attribute of a {{HTMLElement("script")}} element or a {{HTMLElement("link")}} element with [`rel="stylesheet"`](/en-US/docs/Web/HTML/Attributes/rel#stylesheet), [`rel="preload"`](/en-US/docs/Web/HTML/Attributes/rel/preload), or [`rel="modulepreload"`](/en-US/docs/Web/HTML/Attributes/rel/modulepreload).
 
 An `integrity` value begins with at least one string, with each string including a prefix indicating a particular hash algorithm (currently the allowed prefixes are `sha256`, `sha384`, and `sha512`), followed by a dash, and ending with the actual base64-encoded hash.