- What is elhebert/laravel-sri used for?
- It is a Laravel package that generates Subresource Integrity (SRI) hashes for your compiled CSS and JavaScript files and injects them into the script and link tags your application renders. Browsers then compare the downloaded file's hash against the integrity attribute and refuse to execute a file that has been altered. It is most valuable when assets are served from a CDN or from any third-party origin you do not fully control.
- How do I install elhebert/laravel-sri?
- Install it with Composer using composer require elhebert/laravel-sri. On Laravel versions with package auto-discovery the service provider is registered automatically; otherwise add it to your providers list. Check the README for any publishable configuration or asset-path settings you need to adjust.
- Which Laravel versions does laravel-sri support?
- The package tracks Laravel majors, and release 3.5.0 explicitly added Laravel 13 compatibility. The exact supported range is declared in the package's composer.json illuminate/* constraint, so check whether it spans your current version, for example ^11|^12|^13, or only the newest major. Also confirm the supported PHP versions before upgrading.
- Does laravel-sri work with assets served from a CDN?
- Yes, that is the main use case: the hash is computed over the file contents, and the browser verifies that the CDN-served bytes match. Make sure the CDN returns the file byte-for-byte unmodified, since on-the-fly minification or content rewriting will break the hash. The CDN must also send CORS headers when assets are loaded cross-origin.
- How do I output an SRI-protected script or stylesheet tag in Blade?
- Instead of writing a plain script or link tag, use the Blade directive or helper documented by the package so it can attach the integrity and crossorigin attributes for you. The package hashes the referenced asset file and renders the complete tag, so you should not hand-write the integrity value. Keep your asset URLs consistent between hash generation and tag rendering.
- Why is my browser blocking an asset after adding an integrity hash?
- The most common cause is a hash mismatch: the file on disk or at the CDN changed after the hash was generated, or the server transforms it in transit. Regenerate hashes as part of every deployment and clear any hashes the package has cached. Also check the crossorigin attribute and CORS response, since cross-origin SRI fails without them.
- Do I need crossorigin="anonymous" for SRI to work?
- For cross-origin resources, yes: SRI validation on a CDN or third-party asset requires a CORS-enabled fetch, and the tag needs a crossorigin attribute, usually anonymous. The remote server must reply with an Access-Control-Allow-Origin header that permits your site. Same-origin assets do not need the attribute.
- Is there a performance cost to generating SRI hashes?
- Hashing a file is cheap, but reading and hashing every asset on every request is not, so the package's caching behaviour matters. Generate hashes during your build or deploy step where possible, and confirm how results are cached in your environment. If hashing happens at runtime, make sure the cache is warm and shared across workers.
- Can I use laravel-sri with Vite or Laravel Mix?
- SRI applies to the final script and link tags, so it works with any bundler as long as files are hashed after the build and tag output goes through the package. Vite and Mix do not add integrity attributes on their own, so you need to route asset tag rendering through laravel-sri or a build plugin. When using a dev server with hot module replacement, expect SRI to matter only for production builds.
- Is laravel-sri actively maintained, and should I upgrade to 3.5.0?
- Release 3.5.0 was published solely to add Laravel 13 compatibility, which suggests the package still tracks framework majors, but the release note alone does not prove an active test matrix. Review the commit history, CI configuration, and open issues before relying on it. If you are already on Laravel 13, use 3.5.0; if you are on 11 or 12, pin the latest 3.4.x and treat 3.5.0 as part of your eventual framework upgrade.