{"record":{"id":"a3a06ec1f9795195","repo":"sveltejs/kit","slug":"sveltekit-error-message","errorCode":null,"errorMessage":"[SvelteKit] ${error.message}","messagePattern":"\\[SvelteKit\\] (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/kit/src/runtime/server/validate-headers.js","lineNumber":60,"sourceCode":"\t\tconst type = value.split(';')[0].trim();\n\t\tconst error_suffix = `(While parsing \"${value}\".)`;\n\t\tif (!CONTENT_TYPE_PATTERN.test(type)) {\n\t\t\tthrow new Error(`Invalid content-type value \"${type}\". ${error_suffix}`);\n\t\t}\n\t}\n};\n\n/**\n * @param {Record<string, string>} headers\n */\nexport function validateHeaders(headers) {\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tconst validator = HEADER_VALIDATORS[key.toLowerCase()];\n\t\ttry {\n\t\t\tvalidator?.(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof Error) {\n\t\t\t\tconsole.warn(`[SvelteKit] ${error.message}`);\n\t\t\t}\n\t\t}\n\t}\n}\n","sourceCodeStart":42,"sourceCodeEnd":65,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/validate-headers.js#L42-L65","documentation":"SvelteKit validates configured headers (e.g. in the server config used for responses/prerender) against a table of per-header validators. If a validator throws, the invalid value is warned about rather than crashing the build/server. The warning is prefixed with `[SvelteKit]` and shows the underlying validation error message.","triggerScenarios":"A header value set in svelte.config.js or generated by the server fails its validator — e.g. malformed `content-security-policy` directives, invalid `link`/`reload` header syntax — passed through `Object.entries(headers)` in validate-headers.js.","commonSituations":"Hand-written CSP strings with typos or unsupported directives; copying header config from another framework; automated config generation producing invalid header syntax.","solutions":["Read the message after `[SvelteKit]` to identify the offending header and fix its value","Validate CSP with a linter or the CSP evaluator before deploying","Wrap risky dynamic header construction in validation/tests"],"exampleFix":"// before\nheaders: { 'content-security-policy': \"default-src 'self'; script-src 'self' 'inlin-scripts'\" }\n// after\nheaders: { 'content-security-policy': \"default-src 'self'; script-src 'self'\" }","handlingStrategy":"validation","validationCode":"const RISKY = ['content-security-policy', 'link'];\nfor (const [k, v] of Object.entries(headers)) {\n  if (RISKY.includes(k.toLowerCase()) && typeof v !== 'string') {\n    throw new TypeError(`Header ${k} must be a string`);\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate CSP/header strings with a linter before committing","Keep header config simple and static where possible","Watch build output for '[SvelteKit]' header warnings in CI"],"tags":["headers","csp","validation","config"],"backgroundTag":"invalid-header-value","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}