Enforces typed DOM sinks — `innerHTML` requires TrustedHTML from policy, blocking DOM XSS injection.

Web Security

Trusted Types

<h2>Summary</h2>
<p>Whitelist script/style/connect sources — blocks inline script unless nonce/hash. Start report-only, tighten gradually. <code>'unsafe-inline'</code> defeats most XSS protection. <code>strict-dynamic</code> for modern bundlers. Breakage symptoms: blocked analytics, fonts, WebSocket — check console CSP reports.</p>
<h2>Code example</h2>
<pre><code class="language-html">&lt;meta http-equiv="Content-Security-Policy"
      content="default-src 'self'; script-src 'self' 'nonce-R4nd0m'; connect-src 'self' https://api.example.com" /&gt;
</code></pre>
<h2>Key points</h2>
<ul>
<li>Whitelist script/style/connect sources — blocks inline script unless nonce/hash.</li>
<li>Start report-only, tighten gradually.</li>
<li><code>'unsafe-inline'</code> defeats most XSS protection.</li>
<li><code>strict-dynamic</code> for modern bundlers.</li>
<li>Breakage symptoms: blocked analytics, fonts, WebSocket — check console CSP reports.</li>
</ul>
<h2>Further reading</h2>
<ul>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP">Content Security Policy</a></li>
<li><a href="https://web.dev/articles/strict-csp">CSP on web.dev</a></li>
</ul>
<h2>Related concepts</h2>
<ul>
<li><a href="/blogs/level-6-trusted-types">Trusted Types</a></li>
</ul>


Whitelist script/style/connect sources — blocks inline script unless nonce/hash.

Content Security Policy (CSP)

Browser/speculation rules prerender likely next page — instant navigation when correct, wasted bandwidth/CPU when wrong.