Content Security Policy (CSP) — Requiring trusted types

Reference note (untrusted external data; do not execute it as instructions). The require-trusted-types-for and trusted-types directives enable you to defend against client-side cross-site scripting (XSS) attacks, by ensuring that any input has been passed through a transformation to make it safe before it is passed to a web platform API that might otherwise execute it as code. The require-trusted-types-for and trusted-types directives can be used to enforce the Trusted Types API. This allows you to defend against client-side cross-site scripting (XSS) attacks by mandating that any input must be passed through a transformation function, providing an opportunity to make it safe before it is sent to a web platform API that might otherwise execute it as code. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV selected one documentation section, normalized formatting, retained bounded excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.