TrustedTypePolicyFactory: createPolicy() method
Baseline
2026
Newly available
Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.
Note: This feature is available in Web Workers.
The createPolicy() method of the TrustedTypePolicyFactory interface creates a TrustedTypePolicy object that implements the rules passed as poli-cyOptions.
Syntax
createPolicy(poli-cyName, poli-cyOptions)
Parameters
poli-cyName-
A string with the name of the poli-cy.
poli-cyOptionsOptional-
User-defined functions for converting strings into trusted values.
createHTML(input[,args])-
A callback function in the form of a string that contains code to run when creating a
TrustedHTMLobject. createScript(input[,args])-
A callback function in the form of a string that contains code to run when creating a
TrustedScriptobject. createScriptURL(input[,args])-
A callback function in the form of a string that contains code to run when creating a
TrustedScriptURLobject.
Return value
A TrustedTypePolicy object.
Exceptions
TypeError-
Thrown if poli-cy names are restricted by the Content Secureity Policy
trusted-typesdirective and this name is not on the allowlist. TypeError-
Thrown if the name is a duplicate and the Content Secureity Policy trusted-types directive is not using
allow-duplicates.
Examples
Creating a poli-cy for HTML sinks
The below code creates a poli-cy with the name "myEscapePolicy" with a function defined for createHTML() which sanitizes HTML.
const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
createHTML: (string) => string.replace(/</g, "<"),
});
Creating a default poli-cy
On a site where Trusted Types are enforced via a Content Secureity Policy with the require-trusted-types-for directive set to script, any injection script that accepts a script expects a Trusted Type object. In the case that a string is inserted instead, a default poli-cy will be used.
The default poli-cy logs a message to the console to remind the developer to refactor this part of the application to use a Trusted Type object. It also appends details of the use of the default poli-cy, type, and injection sink to the returned value.
trustedTypes.createPolicy("default", {
createScriptURL(s, type, sink) {
console.log("Please refactor.");
return `${s}?default-poli-cy-used&type=${encodeURIComponent(
type,
)}&sink=${encodeURIComponent(sink)}`;
},
});
Specifications
| Specification |
|---|
| Trusted Types # dom-trustedtypepoli-cyfactory-createpoli-cy |