Trusted Types

Summary

Enforces typed DOM sinks — innerHTML requires TrustedHTML from policy, blocking DOM XSS injection. Supported Chromium; polyfill/fallback strategies elsewhere. Integrates with CSP require-trusted-types-for 'script'. Libraries must be compatible or use policy createHTML wrappers.

Code example

if (window.trustedTypes) {
  const policy = trustedTypes.createPolicy('app', {
    createHTML: (input) => DOMPurify.sanitize(input),
  });
  element.innerHTML = policy.createHTML(untrustedHtml);
}

Key points

• Enforces typed DOM sinks — innerHTML requires TrustedHTML from policy, blocking DOM XSS injection.
• Supported Chromium; polyfill/fallback strategies elsewhere.
• Integrates with CSP require-trusted-types-for 'script'.
• Libraries must be compatible or use policy createHTML wrappers.

Further reading

• Trusted Types API
• DOM XSS prevention

Related concepts

• Content Security Policy (CSP)
• DOM clobbering