Trusted Types

ELI5 - The Vibe Check

Trusted Types is the browser refusing to let random strings get shoved into innerHTML unless you've explicitly promised they're safe. Most DOM based XSS bugs happen because some string sneaks into the DOM without anyone checking it. Trusted Types makes the browser enforce that check for you, at the platform level, instead of hoping every developer remembers to sanitize.

Real Talk

Trusted Types is a browser security API, enforced via Content Security Policy, that restricts DOM XSS sink functions like innerHTML or eval to only accept specially typed objects created through a registered policy, rather than raw strings. It forces sanitization or validation logic through an explicit, auditable chokepoint, making DOM based XSS significantly harder to introduce accidentally.

Show Me The Code

// Register a Trusted Types policy
const policy = trustedTypes.createPolicy('safeHTML', {
  createHTML: (input) => DOMPurify.sanitize(input)
});

element.innerHTML = policy.createHTML(userInput);

When You'll Hear This

"We turned on Trusted Types and immediately caught three innerHTML assignments we'd forgotten to sanitize." / "The library broke under Trusted Types because it was building HTML with raw string concatenation."