---
title: "Shipping support for module script integrity in Chrome & Safari"
description: "Shopify’s checkout is a managed service requiring control over scripts to support high-performance, PCIv4 DSS-compliant checkout and prevent tampering. SRI could validate top-level resources but did not cover imported JavaScript modules, forcing a shim for dynamic imports that added maintenance and runtime overhead. The work revived Guy Bedford’s proposal to put integrity hashes in import maps, enabling unchanged dynamic imports while also covering static imports, top-level module scripts, and modulepreload. Support shipped in Chromium 127 for Chrome and Edge, and landed in Safari 18’s beta release, with just over two weeks of full-time work and about seven chronological weeks overall."
---

# Shipping support for module script integrity in Chrome & Safari

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Aug 2, 2024

**Type:** Announcement

## Summary

Shopify’s checkout is a managed service requiring control over scripts to support high-performance, PCIv4 DSS-compliant checkout and prevent tampering. SRI could validate top-level resources but did not cover imported JavaScript modules, forcing a shim for dynamic imports that added maintenance and runtime overhead. The work revived Guy Bedford’s proposal to put integrity hashes in import maps, enabling unchanged dynamic imports while also covering static imports, top-level module scripts, and modulepreload. Support shipped in Chromium 127 for Chrome and Edge, and landed in Safari 18’s beta release, with just over two weeks of full-time work and about seven chronological weeks overall.

## Context

Shopify needed to control which scripts run during its managed checkout to help ensure their contents are not tampered with. Existing Subresource Integrity support covered top-level scripts, styles, and preloads but not imported JavaScript modules, preventing use of import() without a shim that created maintenance challenges and runtime overhead.

## Approach / What changed

The implementation integrates integrity metadata into import maps by mapping module URLs to integrity hashes. Browsers verify a module against its provided hash before execution, preserving unchanged dynamic import() syntax and extending coverage to static imports, top-level module scripts, and modulepreload. The feature was implemented in Chromium and WebKit, reviewed through the WHATWG process, and shipped in Chromium 127 and Safari 18 beta.

## Takeaways

- Import maps associate module URLs with integrity hashes, allowing dynamic imports such as import("./module/shapes/square.js") to be verified before execution.
- The implementation covers static imports, top-level module scripts, and modulepreload in addition to dynamic imports.
- The feature shipped in Chromium 127 for Chrome and Edge and landed in Safari 18 beta; the work took slightly over two weeks of full-time effort and about seven chronological weeks overall.

**Tags:** [Open Source](https://yomu.fyi/topic/open-source), [Performance](https://yomu.fyi/topic/performance)

- Source: [Shopify](https://shopify.engineering/shipping-support-for-module-script-integrity-in-chrome-safari)
- Source URL: https://shopify.engineering/shipping-support-for-module-script-integrity-in-chrome-safari
- Ingested by Yomu: 2026-08-30T13:20:28.220Z

[Read original post](https://shopify.engineering/shipping-support-for-module-script-integrity-in-chrome-safari)