django-sri
Subresource Integrity for Django
Decision gist · record as of 2026-08-14
Yes. django-sri is actively maintained, has no known vulnerabilities, low install friction (Django only), and solves a real security need with a clean API. Use it if you serve static files in Django and want browser-level integrity verification without manual hash management.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Django to be installed; SRI hashes are not output by default when DEBUG=True (set USE_SRI=True to override for local development).
- Low friction: pure Python wheel with only Django as a runtime dependency.
- Actively maintained as of 2026-08-13 with recent releases; supports Django 4.2, 5.0, and 5.1 across Python 3.9–3.13.
License · maintenance · safety
BSD (permissive) — BSD license (permissive) places no restrictions on use, modification, or redistribution in commercial or private projects.
last release 2025-01-21 (570 days) · last repo commit 2026-08-13 · 22 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 140,075 downloads/mo, #11,278 on PyPI
Alternatives
Verify before relying
pip install django-sri
# In settings.py: add 'sri' to INSTALLED_APPS
# In template:
{% load sri %}
{% sri_static "index.js" %}
{% sri_static "index.css" algorithm="sha512" %}
# Or in Python:
from sri import calculate_integrity_of_static
integrity = calculate_integrity_of_static("index.js")- Performance impact of cache lookups and hash computation on large static file sets.
- Compatibility with non-standard static file storage backends beyond manifest-based ones.
What it is and what it does
django-sri is a Django app that automatically computes and injects Subresource Integrity (SRI) hashes into your static file references. It works through template tags that wrap Django's static file system, generating integrity attributes for script and link elements so browsers can verify that fetched resources haven't been tampered with. The package supports SHA256, SHA384, and SHA512 algorithms, caches hashes in Django's caching framework for performance, and integrates seamlessly with static file storage backends like WhiteNoise and manifest-based storage.
You install it, add it to INSTALLED_APPS, then use template tags like `{% sri_static "index.js" %}` instead of the standard static tag. It also provides a Python API for computing integrity hashes directly. By default, hashes are suppressed during local development (when DEBUG=True) to avoid churn as files change, but this is configurable.
Use it for
- Add SRI verification to production Django sites to detect CDN or network-level tampering with static assets.
- Integrate SRI into a Django app serving static files through WhiteNoise or similar middleware without manual hash management.
- Generate SHA512 integrity hashes for high-security applications requiring stronger algorithms than the default SHA256.
- Retrieve bare integrity values for use in custom script/link generation or Content Security Policy headers.
- Support Jinja2 templates alongside Django templates using the sri.jinja2.sri extension for consistent SRI output.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
django-sri is actively maintained, has no known vulnerabilities, low install friction (Django only), and solves a real security need with a clean API. Use it if you serve static files in Django and want browser-level integrity verification without manual hash management.
Install
django-sri on PyPI
Before you install
Low friction: pure Python wheel with only Django as a runtime dependency. Actively maintained as of 2026-08-13 with recent releases; supports Django 4.2, 5.0, and 5.1 across Python 3.9–3.13.
Requires Django to be installed; SRI hashes are not output by default when DEBUG=True (set USE_SRI=True to override for local development).
License in practice
BSD license (permissive) places no restrictions on use, modification, or redistribution in commercial or private projects.
Quickstart
pip install django-sri
# In settings.py: add 'sri' to INSTALLED_APPS
# In template:
{% load sri %}
{% sri_static "index.js" %}
{% sri_static "index.css" algorithm="sha512" %}
# Or in Python:
from sri import calculate_integrity_of_static
integrity = calculate_integrity_of_static("index.js")Verify before relying
- Performance impact of cache lookups and hash computation on large static file sets.
- Compatibility with non-standard static file storage backends beyond manifest-based ones.
Package facts
| License | BSD permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packageDjango |
| Maintenance | Actively maintained 570 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 140,075 / month, #11,278 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Environment :: Web EnvironmentFramework :: DjangoFramework :: Django :: 4.2Framework :: Django :: 5.0Framework :: Django :: 5.1Intended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTPTopic :: Software DevelopmentTyping :: Typed |
Evidence: django_sri-0.8.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “django subresource integrity”
- django-sriGenerates Subresource Integrity (SRI) hashes for Django static files…
- sphinxcontrib-jqueryA Sphinx extension that ensures jQuery is available for use by Sphinx…
- django-safedeleteProvides soft-delete functionality for Django models, allowing…
Give your agent the search over MCP, or paste the wish link into any chat.
More Software Development packages
Provides backported and experimental type hints for Python 3.9+, allowing use of newer typing features on older Python versions and enabling early experimentation with type system PEPs before they enter the standard library.
NumPy provides an N-dimensional array object and a comprehensive suite of mathematical, linear algebra, Fourier transform, and random number functions for scientific computing in Python.
FastAPI is a Python web framework for building REST APIs using type hints, with automatic request validation, serialization, and interactive API documentation.
Provides a way to document function parameters, class attributes, return types, and variables inline using Python's `Annotated` type hint syntax instead of traditional docstrings.
Typer builds command-line applications from Python functions using type hints, automatically generating help text, argument parsing, and shell completion.
Install it if you are building CLIs in Python.
Distlib provides low-level packaging utilities for building, distributing, and managing Python software—including metadata handling, version specifiers, wheel support, script installation, and dependency resolution.
See also django-js-asset · filehash · django-pipeline · dirhash · hashin · dict-hash · checksumdir · pooch · django-statici18n · sphinxcontrib-jquery