Security Recommended

Lock down risky DOM writes

Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Add require-trusted-types-for 'script' and trusted-types <name> to the CSP. Remove innerHTML and similar calls. Send the few you need through one policy that checks its input. Script addresses, such as a service worker's, need a policy too.

Example

Content-Security-Policy: require-trusted-types-for 'script'; trusted-types app

const policy = trustedTypes.createPolicy('app', {
  createHTML: s => s.replace(/[<>&"']/g, c => `&#${c.charCodeAt(0)};`),
});
el.innerHTML = policy.createHTML(userText);

How to check

With the header on, a browser test visits every page and uses its main features. The console shows no Trusted Types violations.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/trusted-types.