Failed to find a valid digest in the ‘integrity’ attribute for resource on a deployed emberjs application

Ember uses Subresource Integrity (SRI) by default to increase the security of applications built with the framework.

The Mozilla Development Network has a good explanation of SRI:

Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.

The hash described there is generated and injected into the index.html at build time of the Ember application. If any part of your stack (deployment, web server, proxy etc.) modifies the file, the hash in index.html won’t match the hash of th served file anymore. The Browser will therefore block the execution of that asset and throw the error you mentioned in your question instead.

The documentation of ember-cli-sri, which provides the integration in Ember build pipeline warns about that one:

In code that uses SRI, you MUST NOT tamper with the built output JavaScript files as code will not load.

Leave a Comment