Trusted Types for DOM Manipulation

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 83)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Working draft
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/trusted-types

Summary

'Trusted Types' offers an (optional) mechanism for web sites to protect themselves against XSS (cross-site scripting) attacks.It limits the attack surface from potentially the entire code base to a handful of "policies" that a developer can implement and install, and whose usage the browser will then enforce. "Trusted types" then ensure that all risk-ful parts of the DOM can only be used by data that has gone through such a developer-supplied policy. Release is expected in Chrome 83.

Standards & signals

Specification: https://w3c.github.io/webappsec-trusted-types/dist/spec/
Firefox: Positive
Safari: No signal
Web developers: Positive — Follow the links on this page: https://github.com/w3c/webappsec-trusted-types/wiki/Integrations
Tracking bug: https://crbug.com/739170

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=trusted-types
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Trusted%20Types%20for%20DOM%20Manipulation
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Trusted%20Types%20for%20DOM%20Manipulation
Baseline status: https://webstatus.dev/?q=Trusted%20Types%20for%20DOM%20Manipulation

Docs: https://w3c.github.io/webappsec-trusted-types/dist/spec/

Samples: https://web.dev/trusted-types/

Explainers: https://github.com/w3c/webappsec-trusted-types/blob/master/explainer.md

View on chromestatus.com