Using the <script> Element to Link External Files

<script>: The Script element

The <script> HTML element is used to embed executable code or data; this is typically used to embed or refer to JavaScript code. The  <script> element can also be used with other languages, such as WebGL's GLSL shader programming language and JSON.

Source: Mozilla, https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script
This work is licensed under a Creative Commons Attribution-ShareAlike 2.5 License.

Attributes

This element includes the global attributes.

async

crossorigin

defer

integrity

nomodule

nonce

referrerpolicy

• no-referrer: The Referer header will not be sent.
• no-referrer-when-downgrade: The  Referer header will not be sent to origins without TLS (HTTPS).
• origin: The sent referrer will be limited to the origin of the referring page: its scheme, host, and port.
• origin-when-cross-origin: The referrer sent to other origins will be limited to the scheme, the host, and the port. Navigations on the same origin will still include the path.
• same-origin: A referrer will be sent for same origin, but cross-origin requests will contain no referrer information.
• strict-origin: Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don't send it to a less secure destination (HTTPS→HTTP).
• strict-origin-when-cross-origin (default): Send a full URL when performing a same-origin request, only send the origin when the protocol security level stays the same (HTTPS→HTTPS), and send no header to a less secure destination (HTTPS→HTTP).
• unsafe-url: The referrer will include the origin and the path (but not the fragment, password, or username).  This value is unsafe, because it leaks origins and paths from TLS-protected resources to insecure origins.

src

type

• Omitted or a JavaScript MIME type: This indicates the script is JavaScript. The HTML5 specification urges authors to omit the attribute rather than provide a redundant MIME type. In earlier browsers, this identified the scripting language of the embedded or imported (via the src attribute) code. JavaScript MIME types are listed in the specification.
  
• module: Causes the code to be treated as a JavaScript module. The processing of the script contents is not affected by the  charset and  defer attributes. For information on using module , see our JavaScript modules guide. Unlike classic scripts, module scripts require the use of the CORS protocol for cross-origin fetching.
  
• Any other value: The embedded content is treated as a data block which won't be processed by the browser. Developers must use a valid MIME type that is not a JavaScript MIME type to denote data blocks. The  src attribute will be ignored.
  

Deprecated attributes

charset If present, its value must be an ASCII case-insensitive match for "utf-8". It’s unnecessary to specify the charset attribute, because documents must use UTF-8, and the script element inherits its character encoding from the document.

language Like the type attribute, this attribute identifies the scripting language in use. Unlike the type attribute, however, this attribute’s possible values were never standardized. The type attribute should be used instead.

Notes

Scripts without async , defer or type="module" attributes, as well as inline scripts, are fetched and executed immediately, before the browser continues to parse the page.

The script should be served with the text/javascript MIME type, but browsers are lenient and only block them if the script is served with an image type (image/*); a video type (video/*); an audio (audio/*) type; or text/csv. If the script is blocked, an error is sent to the element, if not a load event is sent.

Examples

Here are a few examples.

Basic usage

These examples show how to import (an external) script using the <script> element.

<script src="javascript.js"></script>

And the following examples show how to put (an inline) script inside the <script> element.

<script>
  alert("Hello World!");
</script>

Module fallback

Browsers that support the module value for the type attribute ignore any script with a nomodule attribute. That enables you to use module scripts while also providing nomodule-marked fallback scripts for non-supporting browsers.

<script type="module" src="main.js"></script>
<script nomodule src="fallback.js"></script>

Embedding data in HTML

You can also use the <script> element to embed data in HTML with server-side rendering by specifying a valid non-JavaScript MIME type in the type attribute.

<!-- Generated by the server -->
<script id="data" type="application/json">{"userId":1234,"userName":"John Doe","memberSince":"2000-01-01T00:00:00.000Z"}</script>
<!-- Static -->
<script>
 const userInfo = JSON.parse(document.getElementById("data").text);
 console.log("User information: %o", userInfo);
</script>