Change:
The uncompressed, development version of [react.js](https://fb.me/react-{{site.react_version}}.js) and [react-dom.js](https://fb.me/react-dom-{{site.react_version}}.js) with inline documentation (you need both files). ```html <del> <script src="https://fb.me/react-{{site.react_version}}.js" integrity="sha384-{{site.react_hashes.dev}}" crossorigin="anonymous"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.js" integrity="sha384-{{site.react_hashes.dom_dev}}" crossorigin="anonymous"></script> </del> <ins> <script src="https://fb.me/react-{{site.react_version}}.js"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.js"></script> </ins> ``` #### React {{site.react_version}} (production) The compressed, production version of [react.js](https://fb.me/react-{{site.react_version}}.min.js) and [react-dom.js](https://fb.me/react-dom-{{site.react_version}}.min.js) (you need both). ```html <del> <script src="https://fb.me/react-{{site.react_version}}.min.js" integrity="sha384-{{site.react_hashes.prod}}" crossorigin="anonymous"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.min.js" integrity="sha384-{{site.react_hashes.dom_prod}}" crossorigin="anonymous"></script> </del> <ins> <script src="https://fb.me/react-{{site.react_version}}.min.js"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.min.js"></script> </ins> ``` #### React with Add-Ons {{site.react_version}} (development) The uncompressed, development version of React with [optional add-ons](/react/docs/addons.html). ```html <del> <script src="https://fb.me/react-with-addons-{{site.react_version}}.js" integrity="sha384-{{site.react_hashes.addons_dev}}" crossorigin="anonymous"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.js" integrity="sha384-{{site.react_hashes.dom_dev}}" crossorigin="anonymous"></script> </del> <ins> <script src="https://fb.me/react-with-addons-{{site.react_version}}.js"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.js"></script> </ins> ``` #### React with Add-Ons {{site.react_version}} (production) The compressed, production version of React with [optional add-ons](/react/docs/addons.html). ```html <del> <script src="https://fb.me/react-with-addons-{{site.react_version}}.min.js" integrity="sha384-{{site.react_hashes.addons_prod}}" crossorigin="anonymous"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.min.js" integrity="sha384-{{site.react_hashes.dom_prod}}" crossorigin="anonymous"></script> </del> <ins> <script src="https://fb.me/react-with-addons-{{site.react_version}}.min.js"></script> <script src="https://fb.me/react-dom-{{site.react_version}}.min.js"></script> </ins> ``` All scripts are also available via [CDNJS](https://cdnjs.com/libraries/react/).

Discussion:
Pasting the exact code from into a HTML file and opening it through a Python 3.4 HTTP server for some reason gives the following error in Chrome: I'm able to work around this completely by removing the and attributes from the React and React-Dom script tags: I've never had this issue in Chrome before, and I frequently include external scripts with and attributes with no problem, so I'm lead to believe this may have something to do with the way is configured.
I can’t find mentions of or on that page. Can you help me understand where you see it?
Ah, my mistake, this comes when copying over the elements from the Downloads page: , not the tutorial page. I've updated the main post.
Thanks. I can reproduce this. Can you give any insight into this?
Something like might help.
The problem is that the headers aren't being set on the server, so the python gist is irrelevant / will not solve this issue. This is a security feature of browsers, since checking integrity can leak information about the content of the response. fbcdn does allow all origins, but does not, which is the root cause of the error here. Does serve anything directly, or is always just redirects? If it always just redirects, we might be able to blindly enable the CORS headers on without any security impact (thereby relying on the redirect-destination to control the CORS permissions). Otherwise, we would need to enable the cross-origin headers for individual URLs, which will require adding data to the fburl database, which is probably a more intense task. Another option is to use a different URL (not ). Could link directly to the CDN, for instance. I think the shortest term solution is to remove the offending attributes from the script tag, which makes the tags look cleaner/simpler (read: less scary to new user) anyway.
Oh okay, thanks :+1:
is always a redirect, but I thought it was set up right such that this worked. I thought I checked the headers when I those attributes to the docs... maybe not… I think ultimately we shouldn't use but haven't gone and done that yet. We might just set up a little mini-cdn of our own since we have some other issues with the older links (corrupted cache somewhere that we thought we tracked down but still see occasional issues).

cdnjs and jsdelivr are both great external third-party options right now so I definitely recommend them over regardless. We just need some control when we ship releases so relying on them entirely isn't in the cards. I think we should keep the attributes (when they work) - moving towards a world with these checks is a good thing and we can help promote these features. But shorter-term, yea that's fine.
I've used CloudFront in the past, and can certify that it's totally awesome. FWIW.