django-sri

What it is and what it does

django-sri is a Django app that automatically computes and injects Subresource Integrity (SRI) hashes into your static file references. It works through template tags that wrap Django's static file system, generating integrity attributes for script and link elements so browsers can verify that fetched resources haven't been tampered with. The package supports SHA256, SHA384, and SHA512 algorithms, caches hashes in Django's caching framework for performance, and integrates seamlessly with static file storage backends like WhiteNoise and manifest-based storage.

You install it, add it to INSTALLED_APPS, then use template tags like `{% sri_static "index.js" %}` instead of the standard static tag. It also provides a Python API for computing integrity hashes directly. By default, hashes are suppressed during local development (when DEBUG=True) to avoid churn as files change, but this is configurable.

Use it for:

• Add SRI verification to production Django sites to detect CDN or network-level tampering with static assets.
• Integrate SRI into a Django app serving static files through WhiteNoise or similar middleware without manual hash management.
• Generate SHA512 integrity hashes for high-security applications requiring stronger algorithms than the default SHA256.
• Retrieve bare integrity values for use in custom script/link generation or Content Security Policy headers.
• Support Jinja2 templates alongside Django templates using the sri.jinja2.sri extension for consistent SRI output.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates Subresource Integrity (SRI) hashes for Django static files and outputs them in template tags and script/link elements to verify file integrity in the browser.

Yes. django-sri is actively maintained, has no known vulnerabilities, low install friction (Django only), and solves a real security need with a clean API. Use it if you serve static files in Django and want browser-level integrity verification without manual hash management.

Install

django-sri on PyPI

pip install django-sri

uv add django-sri

poetry add django-sri

Installing django-sri

Before you install

Low friction: pure Python wheel with only Django as a runtime dependency. Actively maintained as of 2026-08-13 with recent releases; supports Django 4.2, 5.0, and 5.1 across Python 3.9–3.13.

License in practice

BSD license (permissive) places no restrictions on use, modification, or redistribution in commercial or private projects.

Quickstart

pip install django-sri

# In settings.py: add 'sri' to INSTALLED_APPS

# In template:
{% load sri %}
{% sri_static "index.js" %}
{% sri_static "index.css" algorithm="sha512" %}

# Or in Python:
from sri import calculate_integrity_of_static
integrity = calculate_integrity_of_static("index.js")

Requires Django to be installed; SRI hashes are not output by default when DEBUG=True (set USE_SRI=True to override for local development).

Verify before relying

• Performance impact of cache lookups and hash computation on large static file sets.
• Compatibility with non-standard static file storage backends beyond manifest-based ones.

Package facts

Evidence: django_sri-0.8.0-py3-none-any.whl

Keywords: django, subresource, integrity, sri

Tags

More Software Development packages