Trusted Types
A browser API, enforced through Content Security Policy with require-trusted-types-for 'script', under which dangerous DOM sinks such as innerHTML accept only typed values created by named, reviewed policies, so DOM XSS is blocked at the sink.
- Defined in
- W3C Trusted Types
Covered in
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Render rich text without granting it application privileges
Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Prevent XSS at the output boundary
Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.
Practice: XSS lab: Render a model’s answer as text instead of active markup · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy · HTML sanitization lab: Configure a sanitizer for user comments