Home / Knowledge hub / Trusted Types
Knowledge hub
Trusted Types
A browser feature that blocks unsafe strings from being written into the page.
What it means
Trusted Types is a browser feature that changes how risky page functions behave. Calls such as innerHTML or eval normally accept any string. With Trusted Types on, they accept only a special object that your own code created through a named policy.
A string from a URL, a form or an API response is refused. The browser throws an error instead of putting it into the page, so the dangerous step cannot happen by accident.
Why it matters
DOM-based XSS happens when page code takes untrusted data and writes it somewhere that runs. These bugs hide in large front-end codebases and third-party libraries, and are easy to add in a late change. Trusted Types makes the bug fail safely rather than run.
It also narrows review. Instead of auditing every line, you audit the few policies that produce trusted values. Google reported using it across its own products, and it is a W3C specification.
How it shows up
You turn it on with a content security policy directive: require-trusted-types-for 'script', plus a trusted-types list of allowed policy names. It can be run in report-only mode first. Support is strongest in Chromium-based browsers and not universal.
The mistakes repeat. A default policy that passes everything through, which defeats the point. Sanitising badly inside the policy. Enabling it in production without trial and breaking third-party widgets. Turning it on but leaving other injection routes such as script src untouched. Trial in report-only mode.
Questions people ask
Trusted Types, answered
Does Trusted Types replace output encoding?
No. Encode and sanitise data as you always should. Trusted Types is a safety net that catches the mistakes.
It ensures any string that does reach a risky function came through code you chose.
Is Trusted Types supported in all browsers?
Not yet everywhere. Chromium-based browsers support it; others vary. Where it is unsupported, the header is ignored and nothing breaks.
Use it as an extra layer, not the only one.
What is a Trusted Types policy?
A named piece of code that turns strings into trusted values, for example by running them through a sanitiser.
Only code that can call the policy can produce values the browser will accept.
Will it break my site?
It can, if your code or libraries write raw strings. Start with the report-only mode and fix what is reported.
Many popular frameworks already work with it.
How would we know it works?
Try writing a plain string into a risky function in the browser console. It should throw an error.
A pentest can then attempt DOM injection routes and show which are blocked.
Sources
Where this comes from
Related
Terms that sit next to this one
DOM-based XSS
Script injection that happens in the browser's own code, not in the server's response.
Content Security Policy
A header telling the browser which scripts a page may load.
XSS
An attacker's script running in your pages, in your customers' sessions.
CSP report-only mode
Trying a content security policy by logging breaches without blocking anything.
HTML injection
Getting your page to render markup an outsider supplied, even without running scripts.
What can write to your page?
DOM-based injection routes, and whether a policy really blocks them, are tested on the running app. A finding shows the payload and the page where it ran. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.