Web Security · Senior · Question 8 of 75
How do you roll out Trusted Types in a large existing app?
- 1Enable enforcement immediately and fix whatever breaks in production
- ✓Correct answer: Start with
Content-Security-Policy-Report-Only: require-trusted-types-for 'script', fix the reported sinks, then enforce - 3Add
'unsafe-inline'to make Trusted Types optional
Explanation
Report-only shows every place that passes strings to sinks. A small number of named policies (trusted-types directive) keeps the review surface small.