vite-plugin-sri-gen

Add Subresource Integrity (SRI) hashes to your Vite build automatically.

• Adds integrity to scripts, stylesheets, and modulepreload links in emitted HTML — plus import map integrity, modulepreload injection for lazy chunks, a CSP-safe runtime for dynamic tags, and Vite manifest augmentation for backend-rendered HTML
• Build-only by design — works out of the box for SPA, MPA, and prerendered SSG output
• ESM-only, Node 18+, Vite 4+

Documentation

📚 Full documentation →

• Getting Started
• Configuration Options
• What is SRI?
• Troubleshooting & Limitations

Install

npm i -D vite-plugin-sri-gen

Quick start

// vite.config.ts
import sri from "vite-plugin-sri-gen";

export default {
  plugins: [sri()],
};

That's it — every build gets SRI with sensible defaults. See the configuration reference for algorithm, crossorigin, skip patterns, and more.

[!IMPORTANT] Pure SSR output (HTML rendered at request time) cannot be modified at build time. Prerendered HTML works normally, and backends that render their own HTML can consume SRI hashes from the augmented Vite manifest. Details: SSR, SSG & Prerendering.

Contributing

Contributions are welcome. Please read CONTRIBUTING.md for the fork/branch/PR workflow and the testing/linting expectations.

Security

See SECURITY.md for supported versions and how to report vulnerabilities.

License

MIT — see LICENSE.