---
title: "tags:afterResolve Hook"
description: "Final synchronous tag-resolution hook before sanitization and rendering."
canonical_url: "https://unhead.unjs.io/docs/head/api/hooks/tags-after-resolve"
last_updated: "2026-08-11T00:43:23.822Z"
---

The `tags:afterResolve` hook is the final hook in the tag-resolution chain. It runs after [`tags:resolve`](/docs/head/api/hooks/tags-resolve), but before Unhead removes invalid or empty tags and escapes inline script content.

Both the DOM and SSR renderers use the resulting sanitized array.

## Hook Signature

```ts
export interface Hook {
  'tags:afterResolve': (ctx: TagResolveContext) => SyncHookResult
}

interface TagResolveContext {
  tagMap: Map<string, HeadTag>
  tags: HeadTag[]
}
```

This hook is synchronous. Use `ctx.tags` to change membership or order. Do not implement your own `</script>` escaping here; the resolver performs that sanitization after the hook.

## Usage Example

```ts
import { defineHeadPlugin } from '@unhead/dynamic-import/plugins'

const integrityManagedScripts = new Set([
  'https://cdn.example.com/widget/4.2.0/widget.min.js',
])

export const reportMissingIntegrityPlugin = defineHeadPlugin({
  key: 'report-missing-integrity',
  hooks: {
    'tags:afterResolve': ({ tags }) => {
      for (const tag of tags) {
        if (tag.tag === 'script' && integrityManagedScripts.has(tag.props.src) && !tag.props.integrity)
          console.warn(`Integrity-managed script has no integrity attribute: ${tag.props.src}`)
      }
    }
  }
})
```

Keep the allowlist limited to version-pinned assets whose deployed bytes are immutable. For cross-origin scripts, add `crossorigin: 'anonymous'` to the tag and ensure the response sends an appropriate `Access-Control-Allow-Origin` header; otherwise SRI cannot verify the resource. Subresource Integrity blocks a resource when its bytes no longer match the recorded hash, so it is a poor fit for mutable or unversioned URLs. See MDN's [Subresource Integrity guide](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity#no-cors_mode_and_the_crossorigin_attribute).