require-trusted-types-for, enforce Trusted Types on sinks

The CSP require-trusted-types-for directive forces Trusted Types at DOM XSS sinks, blocking raw string assignment to dangerous APIs.

The require-trusted-types-for directive turns on Trusted Types enforcement at the browser's dangerous DOM sinks. With it in place, assigning a plain string to a sink like innerHTML or eval throws instead of running, which closes off most DOM-based cross-site scripting (XSS).

Now cross-browser

Trusted Types support recently became available across current Chrome, Firefox, and Safari, which all enforce require-trusted-types-for. See Browser support.

It controls whether the browser requires a Trusted Type (rather than a raw string) at injection sinks. The sinks are the APIs that parse a string into executable code or markup, such as Element.innerHTML, document.write, eval, and script src assignment. When enforcement is on, passing a string to one of these throws a TypeError; only a value produced by a registered Trusted Types policy is accepted.

This works together with the trusted-types directive, which controls which policy names may be created. require-trusted-types-for decides that sinks are guarded; trusted-types decides who may produce the trusted values.

Turn on enforcement at every script-related sink:

Content-Security-Policy: require-trusted-types-for 'script'

Fallback chain

require-trusted-types-for has no fallback. default-src does not cover it, so it applies only when listed.

Values

A single sink-group token, 'script'. It enforces Trusted Types for script-related sinks.

Value	Status	Description
`'script'`	✅ Good	Requires a Trusted Type at every script-related DOM sink; raw string assignment throws.

A typical strict setup pairs it with trusted-types to name the allowed policies:

Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify

Examples

Stage it in report-only to find the sinks your code hits before enforcing:

Content-Security-Policy-Report-Only:
    require-trusted-types-for 'script';
    report-to csp-endpoint

Security notes

It protects against DOM XSS, the class of XSS where attacker-controlled data reaches a sink through client-side JavaScript rather than the server's HTML. Output encoding on the server does not catch it. By forcing every sink assignment through a vetted policy, the browser stops a raw string from ever reaching the parser.

Known bypasses and risks

Browsers that predate Trusted Types support ignore the directive, so keep the rest of a strict policy in place rather than relying on it alone. Turning it on without auditing the code base breaks any feature that writes strings to a sink, so most teams roll it out in report-only first using Content-Security-Policy-Report-Only. A poorly written default policy that passes input straight through reintroduces the very sink it was meant to guard.

Recommendation

Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify

Ship require-trusted-types-for 'script', rolled out via a Report-Only header first to find the sinks your code hits, as MDN recommends. With current Chrome, Firefox, and Safari all shipping enforcement (caniuse), the directive is now viable cross-browser.

Reporting

A sink assignment the directive blocks (or would block in report-only mode) emits a csp-violation report naming require-trusted-types-for as the effective directive. Wire delivery with the report-to directive and the Reporting-Endpoints header.

Browser support

Supported cross-browser: current Chrome (and Chromium-based Edge and Opera), Firefox, and Safari. Firefox and Safari support landed recently, so older installed versions still ignore the directive.

require-trusted-types-for