Asset integrity

What is checked

This tool compares the public application files in this build with a generated manifest. The inventory contains the public application JavaScript, styles and fonts, together with five fixed branding and catalogue assets. Each entry records its path, byte length, kind and SHA-256 digest. The build also checks that generated non-admin HTML does not refer to a missing application-bundle file. A deterministic revision identifies the ordered inventory. The manifest is derived from the actual final build files, not a manually maintained list of expected hashes.

How the comparison runs

Nothing runs on a page visit. After you select Start asset check, the browser obtains the existing signed, bounded diagnostic session and reads the manifest. It then requests one listed asset at a time through the diagnostic API. The server reads only its own static asset binding; it cannot fetch a submitted website, private network address or arbitrary path. The browser hashes the returned body with native Web Crypto and compares its size and reported original content type. A response is counted as a full match only when all three checks match.

Reading failures and changed builds

The result separates unavailable files, observed HTTP failures, size mismatch, SHA-256 mismatch and content-type mismatch. A short response may fail both size and hash checks, while an unchanged body with a wrong MIME type fails the type check. Redirects are not followed. An oversized response is rejected within its byte allowance. Every asset request includes the expected manifest revision. When the active inventory changes, the run stops with a build-revision-change result instead of quietly combining files from two builds. An unavailable field is not replaced with a guessed value.

What a successful comparison does not prove

The reference manifest and inspected files come from the same serving system. A match demonstrates self-consistency within this declared inventory, not independent publisher authenticity, a signed supply chain, absence of malware or protection from an attacker controlling the origin. This diagnostic reads through the signed API and static binding. It does not test your previous browser cache, the ordinary public static URL or CDN route, a service worker on another site or regional propagation. Protected admin assets, HTML content, source maps, editorial illustrations and third-party resources are outside this list.

Budgets, cancellation and private evidence

The contract allows at most 32 files, 2 MiB per file and 4 MiB of selected asset bodies. The manifest is limited to 64 KiB. Individual requests have five-second deadlines within a thirty-second run, plus bounded session cleanup. Admission reserves an 8 MiB allowance; conservative per-request manifest and response charges are not measured traffic. Stop prevents follow-on requests, cancels owned work and requests session revocation. Partial observations stay visible but never produce an all-assets verified result. Files are returned as inert bytes and never evaluated by this check. Reports remain in this page unless explicitly exported and exclude asset contents, session credentials, cookies and IP addresses.

Method references and related tools

Cloudflare static asset binding documents the owned file-delivery mechanism. W3C Web Crypto defines native digest operations. A digest match does not provide independent release authenticity.

Resource waterfall · All tools · Overall measurement methodology