# trusted-types (/en/docs/web-security/policies/content-security-policy/directives/trusted-types)



The `trusted-types` directive controls which Trusted Types policies a page is allowed to create. A Trusted Types policy is the only thing that can mint a value the browser accepts at a guarded DOM sink, so this directive decides who in your code may produce those values.

<Callout type="info" title="Now cross-browser">
  Trusted Types support recently became available across current Chrome, Firefox, and Safari, which all support `trusted-types`. See [Browser support](#browser-support).
</Callout>

It restricts the set of policy names that `trustedTypes.createPolicy()` may register. Code can only create a policy whose name is on the allowlist; an attempt to create any other name throws. On its own this directive does not enforce anything at sinks. You enforce sinks with [`require-trusted-types-for`](/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for); `trusted-types` then limits which policies exist to feed those sinks.

The browser gives the name `default` special meaning: a policy registered as `default` runs automatically whenever a string reaches a guarded sink with no explicit Trusted Type, so it is the fallback conversion point.

Allowlist only the policy names your code actually creates:

```http
Content-Security-Policy: trusted-types default dompurify
```

## Fallback chain [#fallback-chain]

`trusted-types` has no fallback. `default-src` does not cover it. (Note the policy-name token `default` is unrelated to the `default-src` directive.)

## Values [#values]

A space-separated list of allowed policy-name tokens, plus these keywords:

| Value                | Status  | Description                                                                                                      |
| -------------------- | ------- | ---------------------------------------------------------------------------------------------------------------- |
| `<policy-name>`      | ✅ Good  | Allow a policy with this exact name to be created.                                                               |
| `'none'`             | ✅ Good  | Forbid creating any policy at all.                                                                               |
| `'allow-duplicates'` | ❌ Risky | Permits registering the same policy name more than once, loosening the one-name-one-policy guarantee.            |
| `*`                  | ❌ Risky | Allows any policy name, so any script (including injected script) can register a policy and mint trusted values. |

In the opening example, the `default` token allows the special default policy and `dompurify` allows a named policy your code registers for sanitizing markup. Prefer an explicit short allowlist like that over broad values.

## Examples [#examples]

Stage Trusted Types in report-only to discover which policy names your code creates:

```http
Content-Security-Policy-Report-Only:
    require-trusted-types-for 'script';
    trusted-types default dompurify;
    report-to csp-endpoint
```

## Known bypasses and risks [#known-bypasses-and-risks]

The directive limits policy creation but does not vet what a policy does, so a weak `default` policy that returns its input unchanged hands an attacker a sink again. Allowing too many names, or `*`, lets injected code mint its own trusted values, and `'allow-duplicates'` loosens the guarantee that a name maps to one known policy. The directive only takes effect alongside `require-trusted-types-for 'script'`, and browsers that predate Trusted Types support ignore it.

## Recommendation [#recommendation]

```http
Content-Security-Policy:
    require-trusted-types-for 'script';
    trusted-types default dompurify
```

Allowlist only the policy names your code actually creates and pair the directive with [`require-trusted-types-for 'script'`](/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for). Roll the pair out via a Report-Only header first, as MDN recommends; with current Chrome, Firefox, and Safari all shipping support (caniuse), Trusted Types is now viable cross-browser.

## Reporting [#reporting]

An attempt to create a policy name outside the allowlist (or a violation caught in report-only mode) emits a [`csp-violation` report](/en/docs/web-security/reporting-api/reports/csp-violation) naming `trusted-types` as the effective directive. Wire delivery with the [`report-to`](/en/docs/web-security/policies/content-security-policy/directives/report-to) directive and the [`Reporting-Endpoints` header](/en/docs/web-security/reporting-api/headers/reporting-endpoints).

## Browser support [#browser-support]

Supported cross-browser: current Chrome (and Chromium-based Edge and Opera), Firefox, and Safari. Firefox and Safari support landed recently, so older installed versions still ignore the directive.

## See also [#see-also]

* [require-trusted-types-for directive](/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for)
* [CSP keywords and values](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)
* [How to enable Trusted Types](/en/blog/enable-trusted-types)
* [Trusted Types and eval in CSP](/en/blog/trusted-types-eval-csp)

## Sources [#sources]

* [MDN, CSP trusted-types](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/trusted-types)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C, Trusted Types](https://www.w3.org/TR/trusted-types/)
* [caniuse, Trusted Types](https://caniuse.com/trusted-types)