Trusted Types
What is Trusted Types?
Trusted TypesBrowser API and CSP directive that prevents DOM-based XSS by requiring dangerous DOM sinks to receive typed, policy-vetted values instead of raw strings.
Trusted Types is a defence designed by Google and standardised as a W3C Working Draft to eliminate DOM-based XSS at its root. When enabled via the require-trusted-types-for 'script' and trusted-types CSP directives, the browser refuses to execute injection sinks — innerHTML, outerHTML, document.write, eval, setTimeout with a string, script.src, iframe.srcdoc and dozens more — whenever they receive a plain string. Code must instead pass typed objects (TrustedHTML, TrustedScript, TrustedScriptURL) minted by named, audited policies via trustedTypes.createPolicy(...). This collapses a codebase's thousands of unsafe sinks down to a handful of reviewable policy functions.
The mechanism ships in Chromium browsers (Chrome and Edge since v83, May 2020); Firefox and Safari implementations remain in progress, so it is deployed as defence-in-depth alongside a strict CSP rather than a sole control. A special policy named default intercepts any string that slips through, letting teams route it through a sanitizer — DOMPurify natively returns TrustedHTML, so DOMPurify.sanitize(html, {RETURN_TRUSTED_TYPE: true}) satisfies enforcement. Google credits Trusted Types with driving DOM XSS to near-zero across products like Search and Photos, since the majority of their historical XSS bugs were client-side. Roll out in Content-Security-Policy-Report-Only mode first to catch violations before enforcing.
flowchart TD
A[Untrusted string<br/>location.hash, postMessage] --> B{Assigned to a<br/>DOM sink? e.g. innerHTML}
B -->|Trusted Types enforced| C{Value is a<br/>TrustedHTML object?}
C -->|Yes, from audited policy| D[Sink executes safely]
C -->|No, raw string| E[Browser throws<br/>TypeError + CSP report]
E --> F[default policy<br/>DOMPurify sanitizes]
F --> C
B -->|No Trusted Types| G[Sink runs raw string<br/>DOM-based XSS]● Examples
- 01
Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default;
- 02
Replacing element.innerHTML = userInput with element.innerHTML = policy.createHTML(userInput).
● Frequently asked questions
What is Trusted Types?
Browser API and CSP directive that prevents DOM-based XSS by requiring dangerous DOM sinks to receive typed, policy-vetted values instead of raw strings. It belongs to the Application Security category of cybersecurity.
What does Trusted Types mean?
Browser API and CSP directive that prevents DOM-based XSS by requiring dangerous DOM sinks to receive typed, policy-vetted values instead of raw strings.
How do you defend against Trusted Types?
Defences for Trusted Types typically combine technical controls and operational practices, as detailed in the full definition above.