Trusted Types / CSP: jsPDF blocked with "This document requires 'TrustedHTML' assignment" — add TrustedTypes policy support
Author: juergenhechtCreated Jul 1, 2026Updated Jul 1, 2026
Short description
When pages enforce Trusted Types via CSP, jsPDF is blocked and throws:
Failed to execute 'write' on 'Document': This document requires 'TrustedHTML' assignment.Cause: jsPDF writes HTML strings into the DOM (e.g. document.write, innerHTML) without producing TrustedHTML via a Trusted Types policy. Under CSPs that require trusted types, these operations are rejected.
Expected behaviour
jsPDF should work on pages that enforce Trusted Types. Concretely, jsPDF should:
- Detect Trusted Types support and create or use a configurable Trusted Types policy.
- Use that policy to produce TrustedHTML (and other Trusted Types if needed) before calling DOM APIs that require it.
- Expose a way for integrators and third-party plugins to reuse the same policy name/instance.
This allows an application to enable jsPDF under a restrictive CSP such as: Content-Security-Policy: require-trusted-types-for 'script'; trusted-types jsPDF;
Source: parallax/jsPDF