Cybersecurity glossary
What is TrustedScriptURL?
Learn what TrustedScriptURL is, how Trusted Types policies validate script.src assignments, how to prevent javascript: and attacker URLs, and how to adopt createScriptURL safely.
Definition
TrustedScriptURL is a Trusted Types object representing a URL that a policy has explicitly approved for use in script-loading sinks such as HTMLScriptElement.src when Trusted Types are enforced.
Why TrustedScriptURL matters
Dynamic script loading is common: script.src = cdn + file. If file or the whole URL is attacker-controlled, the page executes hostile JavaScript. TrustedScriptURL forces those assignments through a policy that can allowlist destinations.
Together with CSP script-src, it closes a frequent DOM XSS and supply-path gap around runtime script injection.
How TrustedScriptURL works
Identify script URL sinks
Find script.src assignments, dynamic import patterns gated by TT, and similar loaders.
Create a createScriptURL policy
Validate candidate URLs against an allowlist of schemes, hosts, and paths.
Reject dangerous schemes
Block javascript:, data:, and unexpected schemes before returning a trusted URL.
Assign the typed URL
script.src = policy.createScriptURL(url) under Trusted Types enforcement.
Layer CSP and SRI
Keep script-src tight and add integrity attributes for static files when possible.
Validation rules that matter
Allowlist hosts
Only your origins and known CDNs—never arbitrary https.
Pin path prefixes
Limit to /static/js/ or hashed asset paths from your build.
Reject javascript:
Script URL sinks must never accept javascript: URLs.
No open redirects
Do not trust URLs that bounce through redirectors you do not control.
Weak vs strong policies
| Policy behavior | Strength |
|---|---|
| Allowlist exact CDN host + path pattern | Strong |
| Allow only relative URLs under /assets/ | Strong for first-party |
| Allow any https: URL | Weak |
| Return input unchanged | Ineffective |
Checklist
- Wrap all dynamic script.src assignments with createScriptURL.
- Implement strict host/path allowlists in the policy.
- Reject javascript: and data: candidates explicitly.
- Prefer build-time script tags with SRI over runtime injection.
- Align allowlists with CSP script-src / strict-dynamic strategy.
- Add unit tests for malicious URL attempts.
- Review marketing tag loaders that concatenate untrusted IDs into script URLs.
- Monitor Trusted Types violations for new loader code paths.
The practical takeaway
TrustedScriptURL is the Trusted Types value for script-loading URL sinks. It ensures script.src-style assignments cannot silently accept arbitrary strings under enforcement.
Validate aggressively inside createScriptURL, keep CSP strict, and prefer static integrity-checked scripts whenever dynamic loading is unnecessary.
Related security terms
Trusted Types
Parent enforcement model that introduces TrustedScriptURL.
TrustedScript
Sibling type for script source text rather than URLs.
Content Security Policy (CSP)
Complements TrustedScriptURL by restricting which scripts may execute.
Subresource Integrity (SRI)
Integrity checking for static script files loaded from URLs.
Frequently asked questions
What is TrustedScriptURL?
It is a typed URL value created by a Trusted Types policy for sinks that load JavaScript from a URL, such as script.src.
Why not assign a string to script.src?
Under Trusted Types enforcement, string assignment to guarded script URL sinks throws. This blocks easy injection of attacker-controlled script locations.
What should createScriptURL validate?
Allow only expected https origins/paths, reject javascript: and data: script URLs, and avoid open redirects into script loading.
Does TrustedScriptURL replace CSP script-src?
No. CSP still controls execution policy. TrustedScriptURL hardens application sink usage; use both.
Can I allow any https URL?
That is weak. Prefer an allowlist of your CDN and first-party script paths.
How does this relate to strict-dynamic?
strict-dynamic trusts scripts loaded by already-trusted scripts. TrustedScriptURL ensures the URL passed into loaders was policy-approved.
Are relative URLs okay?
They can be, if your policy resolves and validates them against a fixed allowlist and does not accept attacker-controlled bases.
References
Explore authoritative guidance and frameworks related to trustedscripturl.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.