{"record":{"id":"2544dcc4f0c836d6","repo":"sveltejs/kit","slug":"content-security-policy-report-only-must-be-spec","errorCode":null,"errorMessage":"`content-security-policy-report-only` must be specified with either the `report-to` or `report-uri` directives, or both","messagePattern":"`content-security-policy-report-only` must be specified with either the `report-to` or `report-uri` directives, or both","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/server/page/csp.js","lineNumber":332,"sourceCode":"\nclass CspReportOnlyProvider extends BaseProvider {\n\t/**\n\t * @param {boolean} use_hashes\n\t * @param {import('types').CspDirectives} directives\n\t * @param {string} nonce\n\t */\n\tconstructor(use_hashes, directives, nonce) {\n\t\tsuper(use_hashes, directives, nonce);\n\n\t\t// If we're generating content-security-policy-report-only,\n\t\t// if there are any directives, we need a report-uri or report-to (or both)\n\t\t// else it's just an expensive noop.\n\t\tif (\n\t\t\tObject.values(directives).some((v) => !!v) &&\n\t\t\t!directives['report-to']?.length &&\n\t\t\t!directives['report-uri']?.length\n\t\t) {\n\t\t\tthrow Error(\n\t\t\t\t'`content-security-policy-report-only` must be specified with either the `report-to` or `report-uri` directives, or both'\n\t\t\t);\n\t\t}\n\t}\n}\n\nexport class Csp {\n\t/** @readonly */\n\tnonce = generate_nonce();\n\n\t/** @type {CspProvider} */\n\tcsp_provider;\n\n\t/** @type {CspReportOnlyProvider} */\n\treport_only_provider;\n\n\t/**\n\t * @param {import('./types.js').CspConfig} config","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/page/csp.js#L314-L350","documentation":"SvelteKit's Csp class validates that a report-only Content-Security-Policy actually has somewhere to send reports. A `content-security-policy-report-only` header with directives but neither `report-to` nor `report-uri` would silently do nothing, so the constructor throws at startup. (Note: report-uri is deprecated; prefer report-to.)","triggerScenarios":"Setting `csp.config.reportOnly.directives` in svelte.config.js with truthy directives (e.g. only 'default-src') but no 'report-to' or 'report-uri'; building the Csp object with reportOnly: true and an incomplete directive object.","commonSituations":"Copying a CSP config from the enforced policy into reportOnly without adding a reporting endpoint; enabling report-only mode to test a policy but forgetting the reporting directive; upgrading SvelteKit and the previously-tolerated config now throws.","solutions":["Add a `report-to` directive (with matching report-to endpoints config) or a `report-uri` to your reportOnly directives.","If you don't need reporting yet, temporarily move those directives to the enforced (non-reportOnly) policy or omit them.","Set the directive to a falsy/empty value if you intended that directive to be disabled.","Test by starting the dev server — the error fires at startup, so fix before deploy."],"exampleFix":"// before (svelte.config.js)\ncsp: { reportOnly: { directives: { 'default-src': ['self'] } } }\n// after\ncsp: { reportOnly: { directives: { 'default-src': ['self'], 'report-to': ['csp-endpoint'] } } }","handlingStrategy":"validation","validationCode":"const d = config.kit.csp.reportOnly.directives;\nif (d && Object.values(d).some(Boolean) && !d['report-to']?.length && !d['report-uri']?.length) {\n  throw new Error('reportOnly CSP needs report-to or report-uri');\n}","typeGuard":null,"tryCatchPattern":"// Fail fast at config load time\ntry {\n  new Csp({ directives: reportOnlyDirectives }, { reportOnly: true });\n} catch (e) {\n  console.error('Invalid CSP config:', e.message);\n  process.exit(1);\n}","preventionTips":["Always pair reportOnly directives with a report-to (preferred) or report-uri directive.","Copy enforced CSP blocks together with their reporting directives.","Smoke-test `vite dev`/`vite build` after CSP config changes; the error throws at startup.","Prefer report-to since report-uri is deprecated."],"tags":["sveltekit","csp","configuration","security"],"backgroundTag":"csp-missing-report-directive","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}