TYPO3 Core

TypoScript¶

includeJS {
    jquery = //ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
    jquery {
        external = 1
        # integrity was computed with https://srihash.org/
        integrity = sha384-Pn+PczAsODRZ2PiGg0IheRROpP7lXO1NTIjiPo6cca8TliBvaeil42fobhzvZd74
    }
}

Generated HTML¶

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js" type="text/javascript" integrity="sha384-Pn+PczAsODRZ2PiGg0IheRROpP7lXO1NTIjiPo6cca8TliBvaeil42fobhzvZd74"></script>

Problem¶

Chrome (at least) does not load the resource and says:

Solution¶

Add attribute crossorigin="anonymous" when using integrity.

Documentation¶

• https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/
• https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity