Posts tagged script-hashes

September 10, 20267 min readUpdated September 22, 2026
What CSP and script hash reports would have shown during the polyfill.io attack
In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.
August 20, 20264 min readUpdated September 22, 2026
How CSP script hash reporting works with report-sha256
Add 'report-sha256' to a Content-Security-Policy and Chrome and Edge send a hash of each script they fetch. How to set it up, what the report contains, and where it helps.

What CSP and script hash reports would have shown during the polyfill.io attack