# require-trusted-types-for (/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for)



The `require-trusted-types-for` directive turns on Trusted Types enforcement at the browser's dangerous DOM sinks. With it in place, assigning a plain string to a sink like `innerHTML` or `eval` throws instead of running, which closes off most DOM-based cross-site scripting (XSS).

<Callout type="info" title="Now cross-browser">
  Trusted Types support recently became available across current Chrome, Firefox, and Safari, which all enforce `require-trusted-types-for`. See [Browser support](#browser-support).
</Callout>

It controls whether the browser requires a Trusted Type (rather than a raw string) at injection sinks. The sinks are the APIs that parse a string into executable code or markup, such as `Element.innerHTML`, `document.write`, `eval`, and script `src` assignment. When enforcement is on, passing a string to one of these throws a `TypeError`; only a value produced by a registered Trusted Types policy is accepted.

This works together with the [`trusted-types`](/en/docs/web-security/policies/content-security-policy/directives/trusted-types) directive, which controls which policy names may be created. `require-trusted-types-for` decides that sinks are guarded; `trusted-types` decides who may produce the trusted values.

Turn on enforcement at every script-related sink:

```http
Content-Security-Policy: require-trusted-types-for 'script'
```

## Fallback chain [#fallback-chain]

`require-trusted-types-for` has no fallback. `default-src` does not cover it, so it applies only when listed.

## Values [#values]

A single sink-group token, `'script'`. It enforces Trusted Types for script-related sinks.

| Value      | Status | Description                                                                             |
| ---------- | ------ | --------------------------------------------------------------------------------------- |
| `'script'` | ✅ Good | Requires a Trusted Type at every script-related DOM sink; raw string assignment throws. |

A typical strict setup pairs it with `trusted-types` to name the allowed policies:

```http
Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify
```

## Examples [#examples]

Stage it in report-only to find the sinks your code hits before enforcing:

```http
Content-Security-Policy-Report-Only:
    require-trusted-types-for 'script';
    report-to csp-endpoint
```

## Security notes [#security-notes]

It protects against DOM XSS, the class of XSS where attacker-controlled data reaches a sink through client-side JavaScript rather than the server's HTML. Output encoding on the server does not catch it. By forcing every sink assignment through a vetted policy, the browser stops a raw string from ever reaching the parser.

## Known bypasses and risks [#known-bypasses-and-risks]

Browsers that predate Trusted Types support ignore the directive, so keep the rest of a strict policy in place rather than relying on it alone. Turning it on without auditing the code base breaks any feature that writes strings to a sink, so most teams roll it out in report-only first using [Content-Security-Policy-Report-Only](/en/docs/web-security/policies/content-security-policy/report-only). A poorly written default policy that passes input straight through reintroduces the very sink it was meant to guard.

## Recommendation [#recommendation]

```http
Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify
```

Ship `require-trusted-types-for 'script'`, rolled out via a Report-Only header first to find the sinks your code hits, as MDN recommends. With current Chrome, Firefox, and Safari all shipping enforcement (caniuse), the directive is now viable cross-browser.

## Reporting [#reporting]

A sink assignment the directive blocks (or would block in report-only mode) emits a [`csp-violation` report](/en/docs/web-security/reporting-api/reports/csp-violation) naming `require-trusted-types-for` as the effective directive. Wire delivery with the [`report-to`](/en/docs/web-security/policies/content-security-policy/directives/report-to) directive and the [`Reporting-Endpoints` header](/en/docs/web-security/reporting-api/headers/reporting-endpoints).

## Browser support [#browser-support]

Supported cross-browser: current Chrome (and Chromium-based Edge and Opera), Firefox, and Safari. Firefox and Safari support landed recently, so older installed versions still ignore the directive.

## See also [#see-also]

* [trusted-types directive](/en/docs/web-security/policies/content-security-policy/directives/trusted-types)
* [CSP keywords and values](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)
* [How to enable Trusted Types](/en/blog/enable-trusted-types)
* [Trusted Types and eval in CSP](/en/blog/trusted-types-eval-csp)

## Sources [#sources]

* [MDN, CSP require-trusted-types-for](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-for)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C, Trusted Types](https://www.w3.org/TR/trusted-types/)
* [caniuse, Trusted Types](https://caniuse.com/trusted-types)