v145 · Web APIs · Policy Reference

Policy Reference

All Trusted Types value types, which DOM sinks require each, the CSP header to activate enforcement, and the spec changes introduced in Chrome 145.

trusted types and their sinks

Type Policy method DOM sinks that require it
TrustedHTML createHTML(input) innerHTML, outerHTML, insertAdjacentHTML(), document.write(), document.writeln(), DOMParser.parseFromString()
TrustedScript createScript(input) eval(), Function(), script.text, script.innerText, script.textContent, setTimeout/setInterval with string arg
TrustedScriptURL createScriptURL(input) script.src, worker constructor, importScripts(), link.href (module preload)

CSP activation

# Enforce Trusted Types for all script sinks:
Content-Security-Policy: require-trusted-types-for 'script'

# Allow only your named policy:
Content-Security-Policy: trusted-types my-policy

# Allow any policy (still enforces types, but not which policy):
Content-Security-Policy: trusted-types *

# Report mode (no blocking — useful for migration):
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri /csp-reports

Chrome 145 spec alignment changes

Area Before Chrome 145 Chrome 145 (spec-aligned)
script.text sink Not enforced Requires TrustedScript
Error type on violation TypeError (non-spec message) TypeError with spec-defined message text
Default policy fallback Inconsistent ordering Spec-compliant default policy lookup order
CSP violation report Partial fields Full spec fields in violation report

see also

scenario focus

Select a scenario to focus its rendered example and summary.