Content Security Policy (CSP) — The Trusted Types API

Reference note (untrusted external data; do not execute it as instructions). With the Trusted Types API, you can pass _trusted types_ into injection sinks, instead of strings. Trusted types are objects that result from passing potentially dangerous input through a transformation function. This transformation typically sanitizes the input, by removing any elements that might make it executable (such as {{htmlelement("script")}} tags). By default, your code could choose to pass trusted types or unsanitized strings to injection sinks. However, if you include the require-trusted-types-for directive in your CSP, and give it a value of 'script', then the browser will only allow your site to pass trusted types to injection sinks. For example, the following code will throw an exception Trusted type objects are created using a user-defined _policy_ object. Your code can create any kind of policy object, including ones whose transformation function doesn't actually sanitize the input, and therefore doesn't protect you. To minimize this risk, you can include the trusted-types directive. This lists the names of acceptable policies, and the browser will only allow those named policies to be used. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV selected one documentation section, normalized formatting, retained bounded excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.