Trusted Types
type: TechArticle
description: Trusted Types make the browser reject plain strings at DOM injection sinks like innerHTML, demanding a vetted typed value instead. Switched on with two CSP directives, it neutralises a whole class of DOM-based XSS.
language: en
is part of: Web Specification Studio
author: Web Specification Studio
publisher: Web Specification Studio
license: https://creativecommons.org/licenses/by/4.0/
date modified: 2026-06-23T10:00:00.000Z
citation: Trusted Types (W3C Working Draft)
  type: CreativeWork
  publisher: W3C
citation: MDN — Trusted Types API
  type: CreativeWork
  publisher: MDN
citation: MDN — Content-Security-Policy: require-trusted-types-for
  type: CreativeWork
  publisher: MDN
citation: OWASP — DOM based XSS Prevention Cheat Sheet
  type: CreativeWork
  publisher: OWASP

Web Specification Studio
type: WebSite

Web Specification Studio
type: Organization

breadcrumb
type: BreadcrumbList
item list element: Home
  type: ListItem
  position: 1
  item: https://webspecification.com/
item list element: Spec
  type: ListItem
  position: 2
  item: https://webspecification.com/spec/
item list element: Security
  type: ListItem
  position: 3
  item: https://webspecification.com/spec/security/
item list element: Trusted Types
  type: ListItem
  position: 4
  item: https://webspecification.com/spec/security/trusted-types/