#sri 4 articles

• Load an SPFx bundle's lazy chunk from the browser console — no clicking through the UIgotchas / spfxPush a fake chunk with a runtime callback into the bundle's webpackJsonp_ array to get its real __webpack_require__, then req.e(chunkId) loads the chunk exactly as the app would — for checking 404s, SRI integrity or…
• Manifest SRI does not cover scripts your SPFx bundle loads itself (pdf.js, tesseract.js, workers)gotchas / spfxPinning the loader in the .sppkg and giving every manifest path and webpack chunk an integrity hash still leaves a hole – third-party libraries your own code injects with a script tag, fetches for a worker or that a…
• Moving a static CDN off GitHub Pages without breaking the apps that load from itgotchas / toolingUpload git blobs, not a Windows working tree (CRLF breaks SRI); allow the new CA in CAA; missing files must stay 404, not 403; Azure static website has no CORS and Front Door ignores the query string by default…
• SPFx adds Subresource Integrity to a script when the manifest path is { path, integrity }gotchas / spfxA component manifest you pass to SPComponentLoader.loadComponent can carry an SRI hash per script resource as path { path, integrity }; SharePoint then emits script integrity crossorigin=anonymous and the browser…