Trusted Types
Trusted Types is a browser API requiring DOM injection sinks (innerHTML, insertAdjacentHTML) to be created through typed security policies, preventing DOM XSS at the source.
Purpose
To enforce security policies at DOM injection points so XSS injections are blocked at development time rather than runtime; defense in depth for CSP.
Mechanism
Once enabled, dangerous sinks like innerHTML accept only the TrustedHTML type, which must be created via trusted policies. document.write, eval, and others also require policies. Policy violations trigger reports or blocking.
Use cases
- DOM XSS eradication
- CSP defense in depth
- Type-safe injection