↩ Back Reports

Prevent DOM-based XSS with Trusted Types and Content Security Policy with `report-uri`

The CSP response header:

Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://viet.has.report/report

Trusted Types with a default policy

show the code ▼

<script>
  trustedTypes.createPolicy('default', {
    createHTML: string => string.replaceAll('<', '&lt;'),
  });
  document.getElementById('prompt-html').onclick = function() {
    const html = prompt('Enter any HTML', 'foo <strong>bar</strong>');
    if (html) {
      document.getElementById('html-me').innerHTML = html;
    }
  }
</script>

Related specs & documents

Trusted Types Editor's Draft
Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types on web.dev
Trusted Types API on MDN