Package description
The ssri npm package is used for parsing, manipulating, serializing, generating, and verifying Subresource Integrity (SRI) hashes. SRI is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.
Generating SRI Hashes
This feature allows you to generate SRI hashes from a given data input. The example code demonstrates how to create an SRI hash using the SHA-384 algorithm.
const ssri = require('ssri');
const integrity = ssri.fromData('some data to hash', {algorithms: ['sha384']});
console.log(integrity.toString());Parsing SRI Hashes
This feature is used to parse an existing SRI hash string into an object that can be easily manipulated. The example code shows how to parse an SRI hash.
const ssri = require('ssri');
const integrity = ssri.parse('sha384-...');
console.log(integrity);Verifying SRI Hashes
This feature allows you to verify that a piece of data matches a given SRI hash. The example code demonstrates how to verify the integrity of data against an SRI hash.
const ssri = require('ssri');
const data = 'some data to verify';
const sri = 'sha384-...';
ssri.checkData(data, sri).then(() => {
console.log('Integrity verified');
}).catch(error => {
console.log('Integrity verification failed');
});The 'crypto' module is a built-in Node.js module that provides cryptographic functionality. It includes a diverse set of functions for hashing, signing, and verifying data. While it does not provide SRI-specific functions, it can be used to generate hashes that could be used for SRI.
This package is a simple implementation of the SHA hash function. It is similar to ssri in that it can create hashes, but it does not have the specific focus on SRI or the ability to parse and verify SRI hashes.
Hasha is a Node.js module for hashing data. It supports multiple algorithms and can hash streams, buffers, and files. While it is similar to ssri in terms of hashing capabilities, it does not include the SRI-specific features for parsing and verifying hashes.
Readme
ssri, short for Simple Subresource Integrity,
is a Node.js utility for parsing, unparsing, and generating Subresource
Integrity hashes.
$ npm install --save ssri
const ssri = require('ssri')
// TODO
The ssri team enthusiastically welcomes contributions and project participation! There's a bunch of things you can do if you want to contribute! The Contributor Guide has all the information you need for everything from reporting bugs to contributing entire new features. Please don't hesitate to jump in if you'd like to, or even ask us questions if something isn't clear.
FAQs
Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
The npm package ssri receives a total of 24,741,478 weekly downloads. As such, ssri popularity was classified as popular.
We found that ssri demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
LDAPjs, an LDAP Client and Server API for Node.js, was decommissioned after its maintainer received an abusive email from a user, raising concerns about this form of abuse as a potential attack vector.
Security News
CISA launched a new project called Vulnrichment to enrich CVEs with details that help prioritize patching and mitigation efforts, as the NVD backlog of unenriched CVEs awaiting analysis surpasses 10,000.
Security News
Socket is joining forces with CISA and other industry leaders at the RSA Conference to sign the Secure by Design pledge, committing to uphold the highest security standards in our products.