title: Content Security Policy / Subresource Integrity for <a> tags?
body: <p>I host a website that allows users to download a file that is stored on a content distribution network (CDN).  The link to the file on the CDN from my site is something like <code>&lt;a href=https://cdndomain.com/path/to/file&gt;</code>.  I’d like to have a way for my users to ensure that file has not been manipulated by the CDN.</p>
  
  <p>Of course, I can publish a hash of the file on my site (which of course is secured by SSL/TLS).  Then, after the user downloads the file, they can take a hash of the file and verify that it matches the hash published on my site.  This is not uncommon.  But, many of my users are not savvy enough to understand this process.  And, even for those that are, this process is somewhat cumbersome.  I’m looking for a more automated/convenient way to ensure that file has not been manipulated.</p>
  
  <p>I know that <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" rel="nofollow noreferrer">Content Security Policy</a> (CSP) and <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity" rel="nofollow noreferrer">Subresource Integrity</a> (SRI) are now supported by Chrome, Firefox, and Safari.  Using CSP/SRI, sites can ensure that .js files, .css files, etc., hosted elsewhere and referenced by <code>&lt;script&gt;</code> or <code>&lt;link&gt;</code> tags have not been manipulated, by including hashes of the target files in the <code>&lt;script&gt;</code> or <code>&lt;link&gt;</code> tags using the <code>integrity</code> attribute, e.g.:</p>
  
  <pre><code>&lt;script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>or </p>
  
  <pre><code>&lt;link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta.3/css/bootstrap.min.css" integrity="sha384-Zug+QiDoJOrZ5t4lssLdxGhVrurbmBWopoEl+M6BdEfwnCJZtKxi1KgxUyJq13dy" crossorigin="anonymous"&gt;
  </code></pre>
  
  <p>This is very convenient, because the browser checks that the hash of the target file matches the hash specified in the <code>integrity</code> attribute ‘behind the scenes’, without any user intervention.  After downloading the file from the CDN, the browser takes a hash of the file and checks that this hash matches the hash provided in the <code>integrity</code> attribute of the <code>&lt;script&gt;</code> or <code>&lt;link&gt;</code> tag.  If the hashes does not match, the browser warns the user and does not execute the script or apply the css stylesheet.   </p>
  
  <p>I’m looking for something similar for a resource referenced in an <code>&lt;a&gt;</code> tag – whereby I can specify a hash of the target resource in the <code>&lt;a&gt;</code> tag, and the browser would perform a similar check after downloading the resource from the CDN, but before making it available to the user, and warn the user if the hashes do not match.  But according to the MDN docs referenced above, CSP and SRI only apply to <code>&lt;script&gt;</code> tags and <code>&lt;link&gt;</code> tags, not to <code>&lt;a&gt;</code> tags.  </p>
  
  <p>Does anyone know of a solution?</p>