Trusted Types Policy Builder

Most DOM-based XSS comes in through a handful of known sinks: innerHTML, outerHTML, document.write, a script src, eval. Trusted Types is the browser mechanism that closes all of them at once — with the policy on, assigning a plain string to any of those sinks throws. Only an object created by a policy you declared gets through.

List the policy names your application creates and the page assembles the header: the trusted-types directive with the allowed names, plus require-trusted-types-for with the value script, which is what actually turns the enforcement on. There is also the option to allow duplicate names, useful when the same code loads twice, and to emit in report-only mode with a report-to destination.

The adoption path that usually works is report mode first. You ship the Report-Only header, let it run for a few days and collect the sinks that would have been blocked — almost always a third-party library nobody remembered writes HTML directly. Only after cleaning those up is it worth switching to the enforcing header.