{"record":{"id":"35a44fbf42ec9c90","repo":"sveltejs/kit","slug":"the-csp-directives-trusted-types-option-must","errorCode":null,"errorMessage":"The `csp.directives['trusted-types']` option must include 'sveltekit-trusted-url' when `serviceWorker.register` is true","messagePattern":"The `csp\\.directives\\['trusted-types'\\]` option must include 'sveltekit-trusted-url' when `serviceWorker\\.register` is true","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/core/config/index.js","lineNumber":144,"sourceCode":" */\nexport function extract_svelte_config(vite_config) {\n\tconst plugin = vite_config.plugins.find((p) => p.name === 'vite-plugin-sveltekit-setup');\n\treturn plugin?.api.options ?? process_config(validate_config({}), vite_config.root);\n}\n\n/**\n * @param {ValidatedConfig} config\n * @param {string} cwd\n * @returns {ValidatedConfig}\n */\nexport function process_config(config, cwd) {\n\tif (\n\t\tconfig.csp?.directives?.['require-trusted-types-for']?.includes('script') &&\n\t\tconfig.serviceWorker.register &&\n\t\tresolve_entry(path.resolve(cwd, config.files.serviceWorker)) &&\n\t\t!config.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url')\n\t) {\n\t\tthrow new Error(\n\t\t\t\"The `csp.directives['trusted-types']` option must include 'sveltekit-trusted-url' when `serviceWorker.register` is true\"\n\t\t);\n\t}\n\n\tconfig.outDir = path.resolve(cwd, config.outDir);\n\tconfig.env.dir = path.resolve(cwd, config.env.dir);\n\n\tfor (const key in config.files) {\n\t\tif (key === 'hooks') {\n\t\t\tconfig.files.hooks.client = path.resolve(cwd, config.files.hooks.client);\n\t\t\tconfig.files.hooks.server = path.resolve(cwd, config.files.hooks.server);\n\t\t\tconfig.files.hooks.universal = path.resolve(cwd, config.files.hooks.universal);\n\t\t} else if (key !== 'lib' /* TODO remove when we remove the `lib` option altogether */) {\n\t\t\t// @ts-expect-error\n\t\t\tconfig.files[key] = path.resolve(cwd, config.files[key]);\n\t\t}\n\t}\n","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/core/config/index.js#L126-L162","documentation":"When Trusted Types (`require-trusted-types-for: 'script'`) is enforced and the service worker is registered, SvelteKit needs the 'sveltekit-trusted-url' entry in csp.directives['trusted-types'] so its internal code can create trusted URLs for the worker. process_config throws if the combination require-trusted-types-for + serviceWorker.register + existing service worker file occurs without that policy entry, because the service worker registration would be blocked by the browser.","triggerScenarios":"process_config (invoked by the Vite plugin handler / extract_svelte_config) sees all of: `kit.csp.directives['require-trusted-types-for']` includes 'script', `kit.serviceWorker.register` is true, the service worker entry file resolves, and `kit.csp.directives['trusted-types']` is missing or does not list 'sveltekit-trusted-url'.","commonSituations":"Teams hardening apps with a strict CSP/Trusted Types policy enable require-trusted-types-for but forget the SvelteKit-specific policy name; copying a generic CSP config from another framework.","solutions":["Add 'sveltekit-trusted-url' to `kit.csp.directives['trusted-types']` in svelte.config.js.","Alternatively set `kit.serviceWorker.register: false` and register the worker manually if you control the policy there.","Alternatively remove 'script' from `require-trusted-types-for` if Trusted Types enforcement is not required."],"exampleFix":"// before\nconst config = { kit: { csp: { directives: { 'require-trusted-types-for': ['script'], 'trusted-types': ['my-policy'] } } } };\n// after\nconst config = { kit: { csp: { directives: { 'require-trusted-types-for': ['script'], 'trusted-types': ['my-policy', 'sveltekit-trusted-url'] } } } };","handlingStrategy":"validation","validationCode":"const kit = config.kit;\nconst needsTT = kit?.csp?.directives?.['require-trusted-types-for']?.includes('script');\nif (needsTT && kit?.serviceWorker?.register !== false &&\n    !kit?.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url')) {\n  throw new Error(\"Add 'sveltekit-trusted-url' to kit.csp.directives['trusted-types']\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  await viteBuild();\n} catch (e) {\n  if (e.message.includes('sveltekit-trusted-url')) {\n    console.error('Trusted Types + service worker requires the sveltekit-trusted-url policy');\n  }\n  throw e;\n}","preventionTips":["When enabling Trusted Types in SvelteKit, always add 'sveltekit-trusted-url' to trusted-types","Keep CSP config in one reviewed place, not spread across presets","Test service worker registration with Trusted Types enabled in dev","Document the SvelteKit-specific CSP requirement for your team"],"tags":["config","csp","security","trusted-types","service-worker"],"backgroundTag":"csp-trusted-types-misconfigured","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}