he  Browser compatibility table  carefully before using this in
production.

The HTTP [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-
Security-Policy) (CSP) **` require-trusted-types-for ` ** Experimental
directive instructs user agents to control the data passed to DOM XSS sink
functions, like [ ` Element.innerHTML ` ](/en-
US/docs/Web/API/Element/innerHTML) setter.

When used, those functions only accept non-spoofable, typed values created by
Trusted Type policies, and reject strings. Together with **[ ` trusted-types `
](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/trusted-types) **
directive, which guards creation of Trusted Type policies, this allows authors
to define rules guarding writing values to the DOM and thus reducing the DOM
XSS attack surface to small, isolated parts of the web application codebase,
facilitating their monitoring and code review.

##  Syntax

http

    
    
    Content-Security-Policy: require-trusted-types-for 'script';
    

` 'script' `

    

Disallows using strings with DOM XSS injection sink functions, and requires
matching types created by Trusted Type policies.

##  Examples

js

    
    
    // Content-Security-Policy: require-trusted-types-for 'script'; trusted-types foo;
    
    const attackerInput = '<svg onload="alert(/cross-site-scripting/)" />';
    const el = document.createElement("div");
    
    if (typeof trustedTypes !== "undefined") {
      // Create a policy that can create TrustedHTML values
      // after sanitizing the input strings with DOMPurify library.
      const sanitizer = trustedTypes.createPolicy("foo", {
        createHTML: (input) => DOMPurify.sanitize(input),
      });
    
      el.innerHTML = sanitizer.createHTML(attackerInput); // Puts the sanitized value into the DOM.
      el.innerHTML = attackerInput; // Rejects a string value; throws a TypeError.
    }
    

##  Specifications

Specification  
---  
[ Trusted Types  
#  require-trusted-types-for-csp-directive  ](https://w3c.github.io/trusted-
types/dist/spec/#require-trusted-types-for-csp-directive)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * [ Cross-Site Scripting (XSS) ](/en-US/docs/Glossary/Cross-site_scripting)
  * [ DOM XSS injection sinks covered by Trusted Types ](https://w3c.github.io/trusted-types/dist/spec/#injection-sinks)
  * [ Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types ](https://web.dev/articles/trusted-types)
  * Trusted Types with [ DOMPurify ](https://github.com/cure53/DOMPurify#what-about-dompurify-and-trusted-types) XSS sanitizer 
  * [ Trusted Types polyfill ](https://github.com/w3c/trusted-types#polyfill)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  Oct 25, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/require-trusted-types-
for/contributors.txt) .

[ View this page on GitHub
](https://github.com/mdn/content/blob/main/files/en-
us/web/http/headers/content-security-policy/require-trusted-types-
for/index.md?plain=1 "Folder: en-us/web/http/headers/content-security-
policy/require-trusted-types-for \(Opens in a new tab\)") â¢  [ Report a
problem with this content
](https://github.com/mdn/content/issues/new?template=page-report.yml&mdn-
url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Frequire-trusted-
types-
for&metadata=%3C%21--+Do+not+make+changes+below+this+line+--%3E%0A%3Cdetails%3E%0A%3Csummary%3EPage+report+details%3C%2Fsummary%3E%0A%0A*+Folder%3A+%60en-
us%2Fweb%2Fhttp%2Fheaders%2Fcontent-security-policy%2Frequire-trusted-types-
for%60