The crossorigin attribute tells the browser to request a file using CORS. Subresource Integrity needs it for cross-origin scripts, because a request without CORS will fail when integrity is present. Use crossorigin="anonymous" for CDN files so credentials are not sent, and confirm the server returns CORS headers.
Values
| Value | Behavior |
|---|---|
| anonymous | Uses CORS. Credentials such as cookies are sent only to the same origin |
| use-credentials | Uses CORS and always includes credentials |
| Empty attribute | Same as anonymous |
| Invalid keyword | Treated as anonymous |
| Attribute absent | CORS is not used at all |
These come from MDN's crossorigin attribute page. For scripts, a missing attribute also limits what error information reaches window.onerror, and MDN's script page says to use crossorigin to allow error logging for sites that serve static files from a separate domain.
Why SRI cares
MDN's SRI guide says cross-origin requests that use integrity must use CORS. Without the crossorigin attribute the request goes out without CORS, and the browser will always fail it when an integrity value is present. The reason given is that allowing it would let an attacker use hash matching to infer the contents of a resource.
So the pair is always written together:
<script
src="https://cdn.example.com/lib.js"
integrity="sha384-REPLACE_WITH_REAL_HASH"
crossorigin="anonymous"></script>
The hash is a placeholder. Generate yours from the exact file.
What the server must send
The remote server must respond with an Access-Control-Allow-Origin header that permits your page. Public CDNs commonly allow any origin. A vendor's own server may not, in which case hashed loading will fail and you will need to self-host or ask them to enable CORS.
Troubleshooting a blocked script
- Open the browser console. A mismatch and a CORS failure produce different messages.
- Check the network tab for the response headers on the script request.
- Confirm the crossorigin attribute is present on the tag.
- Recompute the hash from the exact bytes the server returns, since a CDN may minify or change encoding.
- Make sure no other layer rewrites the file, such as an optimizing proxy.
Anonymous or use-credentials
Use anonymous for public libraries. Choose use-credentials only when the resource requires your cookies, which is rare for scripts. It forces the server to answer with stricter CORS headers, so it is harder to get right.
Module scripts
MDN notes that, unlike classic scripts, module scripts require CORS for cross-origin fetching. See does SRI work with ES modules and import maps.
Safeguard's dependency scanning covers packages in your own build, with a free scan at gold.safeguard.sh/scan.
Quick check
Can I put integrity on a script without crossorigin?
For a cross-origin file, no. The request will fail. Add crossorigin and make sure the server allows CORS.
Does crossorigin send my cookies to the CDN?
With anonymous, credentials are sent only to the same origin, so a CDN on another origin does not receive them.
Sources
- MDN, crossorigin attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/crossorigin
- MDN, Subresource Integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity
- MDN, script element: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script
Last reviewed: 19 October 2026.
