TrustedScriptURL

Baseline 2026

Newly available

Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.

Learn more
See full compatibility

Note: This feature is available in Web Workers.

The TrustedScriptURL interface of the Trusted Types API represents a string that a developer can insert into an injection sink that will parse it as a URL of an external script. These objects are created via TrustedTypePolicy.createScriptURL() and therefore have no constructor.

The value of a TrustedScriptURL object is set when the object is created and cannot be changed by JavaScript as there is no setter exposed.

Instance methods

TrustedScriptURL.toJSON(): Returns a JSON representation of the stored data.
TrustedScriptURL.toString(): A string containing the sanitized URL.

Examples

The constant sanitized is an object created via a Trusted Types policy.

const sanitized = scriptPolicy.createScriptURL(
  "https://example.com/my-script.js",
);
console.log(sanitized); /* a TrustedScriptURL object */

Specifications

Specification
Trusted Types # trused-script-url

Browser compatibility

Help improve MDN

Was this page helpful to you?

Yes No

Learn how to contribute

This page was last modified on Mar 10, 2025 by MDN contributors.

View this page on GitHub Report a problem with this content

Trusted Types API
TrustedScriptURL
Instance methods
1. toJSON()
2. toString()
Related pages for Trusted Types API