diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md index dbd7cd59159..7b40cad41d7 100644 --- a/docs/getting-started/installation.md +++ b/docs/getting-started/installation.md @@ -27,6 +27,37 @@ Chart.js built files are also available through [jsDelivr](https://www.jsdelivr. +## Security Considerations + +When loading Chart.js from a CDN, it's recommended to use **Subresource Integrity (SRI)** to protect against tampered or malicious scripts. Here are secure examples: + +### CDNJS with SRI + +```html + +``` + +### jsDelivr with SRI + +```html + +``` + +**Benefits of SRI:** +- Prevents execution of tampered scripts from CDNs +- Protects against supply chain attacks +- Ensures script integrity in production environments + +You can generate integrity hashes for any Chart.js version using tools like [SRI Hash Generator](https://www.srihash.org/) or find them on [cdnjs.com](https://cdnjs.com/libraries/Chart.js). + ## GitHub [![github](https://img.shields.io/github/release/chartjs/Chart.js.svg?style=flat-square&maxAge=600)](https://github.com/chartjs/Chart.js/releases/latest)