Almost all of the articles I read about subresource integrity cover loading scripts (and CSS) from CDNs and third-party resources, which makes sense.
Is there any value in adding the
integrity attribute to my own (i.e. first-party) scripts?
My site is served using HTTPS so the scripts shouldn't be modified in transit (if an attacker can modify the information in transit from my server then they can modify the HTML anyways).
With regards to the scripts themselves being modified, I would think that if an attacker is able to modify the contents of the files on my server then I have much bigger problems than that can be protected by SRI.
Should I put in the time to implement SRI for first-party scripts? I have a build process already so it isn't difficult to generate the hashes but populating the
<script> tags is a tad difficult in my current workflow.
I know it is not supported by Microsoft Edge but that is an orthogonal concern AFAIK.