CSP require-trusted-types-for
Forces dangerous DOM sinks to accept only typed, sanitised values.
- Falls back to
- nothing — must be set explicitly
- Group
- Reporting and hardening
Detail
The strongest available defence against DOM-based XSS. With require-trusted-types-for 'script', assignments to innerHTML and similar sinks throw unless the value came through a registered policy. Support is Chromium-only for now, and retrofitting it to an existing codebase is real work — but it eliminates a class of bug rather than mitigating it.
Example
require-trusted-types-for 'script'; trusted-types default