Trusted Types

web security

Definition

Trusted Types

Trusted Types lockdown dangerous injection sinks — functions that parse a string as HTML or script (innerHTML, document.write, eval, …) — so they cannot be called with plain strings. The only accepted argument is a type-safe object produced inside a Trusted Type Policy, a small piece of JavaScript the application declares. Policies are enabled through the trusted-types directive of CSP.

The set of sinks is otherwise unbounded, so the practical effect is a TCB reduction: the only code that can introduce a DOM XSS is the policy code itself, not every call site.

Pairing Trusted Types with the HTML Sanitizer API means even policy code can stay safe with little effort, since the sanitizer already produces safe markup.