{"record":{"id":"cf3cb7d8189a8a6d","repo":"sveltejs/kit","slug":"cannot-use-prerendering-if-config-csp-mode-no","errorCode":null,"errorMessage":"Cannot use prerendering if config.csp.mode === \"nonce\"","messagePattern":"Cannot use prerendering if config\\.csp\\.mode === \"nonce\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/server/page/render.js","lineNumber":65,"sourceCode":" *   error_components?: Array<import('svelte').Component | undefined>\n * }} opts\n */\nexport async function render_response({\n\tbranch,\n\tfetched,\n\tpage_config,\n\tstatus,\n\terror = null,\n\tevent,\n\tstate,\n\tresolve_opts,\n\taction_result,\n\tdata_serializer,\n\terror_components\n}) {\n\tif (state.prerendering || state.prerender_default === true) {\n\t\tif (options.csp.mode === 'nonce') {\n\t\t\tthrow new Error('Cannot use prerendering if config.csp.mode === \"nonce\"');\n\t\t}\n\n\t\tif (options.app_template_contains_nonce) {\n\t\t\tthrow new Error('Cannot use prerendering if page template contains %sveltekit.nonce%');\n\t\t}\n\t}\n\n\tconst client = manifest.client;\n\n\tconst modulepreloads = new Set(client?.imports);\n\tconst stylesheets = new Set(client?.stylesheets);\n\n\t/** @type {Map<string, import('types').FontDependency>} */\n\tconst fonts = new Map(client?.fonts.map((font) => [font.file, font]));\n\n\t/**\n\t * The value of the Link header that is added to the response when not prerendering\n\t * @type {Set<string>}","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/page/render.js#L47-L83","documentation":"Nonce-based CSP (`csp.mode === 'nonce'`) requires a unique nonce per response, which conflicts with prerendering, where a single HTML file is generated once and served many times. SvelteKit throws at render time to prevent serving pages with a reused or invalid nonce.","triggerScenarios":"`svelte.config.js` sets `kit.csp.mode: 'nonce'` while a page is prerendered (`export const prerender = true`, `prerender` entries, or `prerender_default === true`) and `render_response` runs during the prerender build.","commonSituations":"Enabling nonce CSP for security hardening while prerender entries exist; adding prerender = true to a landing page in an app that already uses nonce CSP; running `vite build` with the adapter's prerender pass.","solutions":["Set `kit.csp.mode` to 'hash' or 'auto' instead of 'nonce' in svelte.config.js","Disable prerendering for the affected pages (`export const prerender = false`)","If hashes suffice, use hash-mode CSP which is compatible with static output"],"exampleFix":"// before (svelte.config.js)\ncsp: { mode: 'nonce' }\n// after\ncsp: { mode: 'hash' }","handlingStrategy":"validation","validationCode":"// validate config before build\nif (config.kit.csp.mode === 'nonce' && pages.some((p) => p.prerender)) {\n  throw new Error('csp nonce is incompatible with prerendering');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer csp mode 'hash' or 'auto' when any page is prerendered","Grep svelte.config.js for mode: 'nonce' when enabling prerender","Run the build locally after CSP changes to catch the conflict early"],"tags":["csp","prerendering","config"],"backgroundTag":"csp-nonce-prerender-conflict","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}