Firefox 145 for developers

Changes for web developers

Changes for add-on developers

• Cookies created with cookies.set() are now validated, and invalid cookies are rejected. This change was implemented in Nightly only from Firefox 142. (Firefox bug 1976509)

Experimental web features

These features are shipping in Firefox 145 but are disabled by default. To experiment with them, search for the appropriate preference on the about:config page and set it to true. You can find more such features on the Experimental features page.

• Trusted Types API for scripts (Early Beta): dom.security.trusted_types.enabled

  The Trusted Types API is now fully implemented. (Firefox bug 1976656).

  The changes include:

  • Addition of new interfaces TrustedTypePolicyFactory, TrustedTypePolicy, TrustedHTML, TrustedScript, TrustedScriptURL, and the trustedTypes property on Window and WorkerGlobalScope
  • Updates to injection sink APIs, such as Element.innerHTML and document.write(), to allow the TrustedHTML, TrustedScript, TrustedScriptURL to be passed as well as strings.
  • Support for the require-trusted-types-for directive of the Content-Security-Policy HTTP header. This can be used to enforce that trusted types used instead of strings (or use a default policy).
  • Support for the trusted-types directive of the Content-Security-Policy HTTP header. This can be used to restrict the allowed names of trusted type policies defined in the page.