# SRI-pinned loader

> Embed a fixed widget version with Subresource Integrity for an end-to-end integrity chain under strict security policies.

Source: https://shopassist.coec.dk/docs/widget/sri-pinned-loader · Updated 2026-10-01

The channel loader (`/widget/v1/loader.js`) always serves the current widget and verifies a signed manifest before loading the chat app. A **pinned** loader is a fixed version with a published Subresource Integrity hash, so the browser refuses any changed file:

```html
<script src="https://cdn.shopassist.coec.dk/widget/<version>/loader.js" async
        integrity="sha384-<published hash>" crossorigin="anonymous"
        data-shopassist-key="pk_live_YOUR_PUBLISHABLE_KEY" data-platform="generic"></script>
```

The first pinned release is published with the widget's general availability; until then use the channel loader below. Your dashboard shows the current version and hash.

## How the chain works [#chain]

* The pinned `loader.js` is checked by the browser against `integrity`.
* The loader has the file names and hashes of the app, its styles and language packs built in, and loads each with SRI.
* Nothing is fetched without a hash, so a compromised CDN can't change what runs on your page.

## Updating [#updating]

A pinned version never changes. Security fixes and new features need a new version: update the `src` and `integrity`. The dashboard shows "Your pinned widget 1.2.0 is 3 minor versions behind" when you fall behind; [plugins](/docs/plugins) and the changelog list releases.

Plugins can pin a version too (in their advanced settings); they then print the same tag.