Invalid SHA provided by Amplitude, does not match the SHA for file from CDN

[galczo5]

Expected Behavior

Correct SHA provided in the docs.

Current Behavior

Error in console after adding script to page: Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdn.amplitude.com/libs/amplitude-8.17.0-min.gz.js' with computed SHA-384 integrity '+EO59vL/X7v6VE2s6/F4HxfHlK0nDUVWKVg8K9oUlvffAeeaShVBmbORTC2D3UF+'. The resource has been blocked.

Possible Solution

SHA-384 provided by Amplitude is correct.

Steps to Reproduce

Add script to any html file.

Environment

• JS SDK Version: https://cdn.amplitude.com/libs/amplitude-8.17.0-min.gz.js
• Installation Method: script
• Browser and Version: Chrome 99

[kevinpagtakhan]

Hi @galczo5, may we ask where you found the amplitude snippet? We'll take a look and resolve any issues!

[galczo5]

Yeah, sure. I found it in page after url like: https://analytics.amplitude.com//connections/project//sources/setup/SDK_JS

It looks like this:

It has worked for me on Friday, right now it's throwing that error.

Btw. I see that in the docs, there is different SHA https://developers.amplitude.com/docs/javascript

;r.integrity="sha384-MBHPie4YFudCVszzJY9HtVPk9Gw6aDksZxfvfxib8foDhGnE9A0OriRHh3kbhG3q"

Which one is the right one?

[kevinpagtakhan]

Hmm that's odd. Both seem incorrect for the latest version. We'll have to investigate further why the Amplitude dashboard is providing a different hash value. The hash value from https://developers.amplitude.com/docs/javascript is for v8.16.1. In the meantime, this file has the correct hash value: https://github.com/amplitude/Amplitude-JavaScript/blob/main/src/amplitude-snippet.js. Let me know if this works!

[kevinpagtakhan]

@galczo5, Thanks again for flagging this. The fix to Amplitude dashboard is in progress.

[kevinpagtakhan]

The fix to Amplitude dashboard is now in prod environment. Closing.

[galczo5]

It's working now, thanks!