Web Security · Middle · Question 10 of 75

What do Trusted Types add on top of normal XSS defenses?

1They replace CSP completely
2They encrypt every string in the DOM
✓Correct answer: DOM sinks like innerHTML accept only special typed objects created by approved policies, not plain strings

Explanation

Enabled with require-trusted-types-for 'script' in CSP, they turn DOM XSS into a type error and force all HTML through a few reviewed places.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.