Browser & Web Performance · Senior · Question 48 of 75

What do Trusted Types enforce?

Content-Security-Policy: require-trusted-types-for 'script'

✓Correct answer: Dangerous DOM sinks like innerHTML and eval accept only typed objects created by a policy, not plain strings
2All JavaScript must be written in TypeScript
3Only scripts with a valid signature can load

Explanation

This turns DOM XSS into a reviewable problem: only a few policy functions can create HTML, and they can sanitize it.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.