trusted-types directive, allowlist Trusted Types policies

The CSP trusted-types directive allowlists which Trusted Types policy names a page may create, locking down who can produce trusted values.

The trusted-types directive controls which Trusted Types policies a page is allowed to create. A Trusted Types policy is the only thing that can mint a value the browser accepts at a guarded DOM sink, so this directive decides who in your code may produce those values.

Now cross-browser

Trusted Types support recently became available across current Chrome, Firefox, and Safari, which all support trusted-types. See Browser support.

It restricts the set of policy names that trustedTypes.createPolicy() may register. Code can only create a policy whose name is on the allowlist; an attempt to create any other name throws. On its own this directive does not enforce anything at sinks. You enforce sinks with require-trusted-types-for; trusted-types then limits which policies exist to feed those sinks.

The browser gives the name default special meaning: a policy registered as default runs automatically whenever a string reaches a guarded sink with no explicit Trusted Type, so it is the fallback conversion point.

Allowlist only the policy names your code actually creates:

Content-Security-Policy: trusted-types default dompurify

Fallback chain

trusted-types has no fallback. default-src does not cover it. (Note the policy-name token default is unrelated to the default-src directive.)

Values

A space-separated list of allowed policy-name tokens, plus these keywords:

Value	Status	Description
`<policy-name>`	✅ Good	Allow a policy with this exact name to be created.
`'none'`	✅ Good	Forbid creating any policy at all.
`'allow-duplicates'`	❌ Risky	Permits registering the same policy name more than once, loosening the one-name-one-policy guarantee.
`*`	❌ Risky	Allows any policy name, so any script (including injected script) can register a policy and mint trusted values.

In the opening example, the default token allows the special default policy and dompurify allows a named policy your code registers for sanitizing markup. Prefer an explicit short allowlist like that over broad values.

Examples

Stage Trusted Types in report-only to discover which policy names your code creates:

Content-Security-Policy-Report-Only:
    require-trusted-types-for 'script';
    trusted-types default dompurify;
    report-to csp-endpoint

Known bypasses and risks

The directive limits policy creation but does not vet what a policy does, so a weak default policy that returns its input unchanged hands an attacker a sink again. Allowing too many names, or *, lets injected code mint its own trusted values, and 'allow-duplicates' loosens the guarantee that a name maps to one known policy. The directive only takes effect alongside require-trusted-types-for 'script', and browsers that predate Trusted Types support ignore it.

Recommendation

Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify

Allowlist only the policy names your code actually creates and pair the directive with require-trusted-types-for 'script'. Roll the pair out via a Report-Only header first, as MDN recommends; with current Chrome, Firefox, and Safari all shipping support (caniuse), Trusted Types is now viable cross-browser.

Reporting

An attempt to create a policy name outside the allowlist (or a violation caught in report-only mode) emits a csp-violation report naming trusted-types as the effective directive. Wire delivery with the report-to directive and the Reporting-Endpoints header.

Browser support

Supported cross-browser: current Chrome (and Chromium-based Edge and Opera), Firefox, and Safari. Firefox and Safari support landed recently, so older installed versions still ignore the directive.

trusted-types