---
title: "Feature: #109187 - Add integrity property to CSS includes"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:feature-109187-1774695399"
source: "Changelog/14.2/Feature-109187-AddIntegrityPropertyToCssIncludes.rst"
typo3-version: "14.2"
typo3-major: 14
type: "feature"
issue: 109187
forge: "https://forge.typo3.org/issues/109187"
tags: ["Frontend", "TypoScript", "ext:frontend"]
rendered: "2026-09-20T18:31:11+00:00"
---

# Feature: #109187 - Add integrity property to CSS includes {#feature-109187-1774695399}

See [forge#109187](https://forge.typo3.org/issues/109187)

## Description {#description}

The TypoScript properties `includeCSS` and
`includeCSSLibs` now support the `integrity`
property for Subresource Integrity (SRI) checking, bringing CSS includes
to parity with existing SRI support in `includeJS`,
`includeJSFooter`, `includeJSLibs`, and
`includeJSFooterlibs`.

The `crossorigin` property is also supported. When
`integrity` is set without an explicit
`crossorigin` value for URI resources (for example, external
URLs), `crossorigin="anonymous"` is automatically added,
which is required for SRI validation to work cross-origin.

The `integrity` attribute has not yet been added to inline styles
(`inline = 1`), as SRI only applies to external
resources.

The `PageRenderer::addCssFile()` and
`PageRenderer::addCssLibrary()` methods have gained two new
parameters, `$integrity` and `$crossorigin`.

## Impact {#impact}

It is now possible to add SRI integrity hashes to CSS files included via
TypoScript:

```typoscript
page.includeCSS {
    main = https://cdn.example.com/styles/main.css
    main.integrity = sha384-abc123==
    # crossorigin is auto-set to "anonymous" when integrity is given
}

page.includeCSSLibs {
    vendor = https://cdn.example.com/vendor.css
    vendor.integrity = sha384-xyz789==
    vendor.crossorigin = anonymous
}
```

This results in the following HTML output:

```html
<link rel="stylesheet" href="https://cdn.example.com/styles/main.css" media="all" integrity="sha384-abc123==" crossorigin="anonymous">
```

> [!NOTE]
> The integrity hash value can be generated using browser
> developer tools or command-line tools. See [Subresource Integrity on
> MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity)
> for details on how to generate and use integrity hashes.