{"record":{"id":"f90f439afef98152","repo":"withastro/astro","slug":"context-csp-was-used-when-rendering-the-route-co","errorCode":null,"errorMessage":"context.csp was used when rendering the route ${colors.green(state.routeData!.route)}, but CSP was not configured. For more information, see https://docs.astro.build/en/reference/configuration-reference/#securitycsp","messagePattern":"context\\.csp was used when rendering the route (.+?), but CSP was not configured\\. For more information, see https://docs\\.astro\\.build/en/reference/configuration-reference/#securitycsp","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/astro/src/core/fetch/fetch-state.ts","lineNumber":664,"sourceCode":"\t\tif (this.manifest.adapterName) {\n\t\t\tthrow new AstroError({\n\t\t\t\t...AstroErrorData.ClientAddressNotAvailable,\n\t\t\t\tmessage: AstroErrorData.ClientAddressNotAvailable.message(this.manifest.adapterName),\n\t\t\t});\n\t\t}\n\n\t\tthrow new AstroError(AstroErrorData.StaticClientAddressNotAvailable);\n\t}\n\n\tgetCookies(): AstroCookies {\n\t\treturn this.cookies;\n\t}\n\n\tgetCsp(): APIContext['csp'] {\n\t\tconst state = this;\n\t\tif (!this.manifest.csp) {\n\t\t\tif (getEnvironment(this.manifest).runtimeMode === 'production') {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t'csp',\n\t\t\t\t\t`context.csp was used when rendering the route ${colors.green(state.routeData!.route)}, but CSP was not configured. For more information, see https://docs.astro.build/en/reference/configuration-reference/#securitycsp`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t\t// Dedupe fallback warnings to once per family+kind for the lifetime of this request.\n\t\tconst warnedFallback = new Set<string>();\n\t\tconst warnFallback = (family: 'script' | 'style', kind: CspKind) => {\n\t\t\tif (kind === 'default' || !state.result) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst directive =\n\t\t\t\tfamily === 'script' ? state.result.scriptDirective : state.result.styleDirective;\n\t\t\t// Astro's element hashes are folded into the `-elem` directive automatically, so the\n\t\t\t// footgun is specifically user-provided `default`-kind resources on the general directive,\n\t\t\t// which do NOT carry over to the more specific directive.\n\t\t\tconst defaultResources = directive.resources","sourceCodeStart":646,"sourceCodeEnd":682,"githubUrl":"https://github.com/withastro/astro/blob/e294953aa8aadd98d5be92e60a03037b05dbdfd4/packages/astro/src/core/fetch/fetch-state.ts#L646-L682","documentation":"context.csp (Astro.csp) only exists when security.csp is configured in astro.config. Reading it when this.manifest.csp is absent returns undefined, and in production runtime mode it also logs this warning pointing at the docs — resource/hash injection cannot work because no CSP policy exists. Dev mode returns undefined silently.","triggerScenarios":"Route or middleware code accesses Astro.csp / context.csp (e.g. to add script or style resources) while astro.config has no security.csp block, or security.csp is left at its default false.","commonSituations":"Copy-pasting CSP helper code before enabling the feature; a typo placing `csp` at the config top level instead of under `security`; environment-divergent configs where CSP is only set for one environment.","solutions":["Enable CSP in astro.config: security: { csp: { algorithm: 'sha256', scriptDirective: {...}, styleDirective: {...} } } (or csp: true for defaults)","Or guard the call site: `if (Astro.csp) { ... }` where CSP support is optional","Verify you edited the config that applies to the environment where the warning appears (production runtime)"],"exampleFix":"// before — astro.config.mjs with no security.csp, but routes use Astro.csp\nexport default defineConfig({});\n\n// after\nexport default defineConfig({\n  security: {\n    csp: {\n      algorithm: 'sha256',\n      scriptDirective: { resources: [{ value: \"'self'\" }] },\n    },\n  },\n});","handlingStrategy":"type-guard","validationCode":"// CI: code touching Astro.csp requires security.csp in the config\nimport config from './astro.config.mjs';\nif (!config.security?.csp && usesCspApi) {\n  throw new Error('security.csp must be configured before using Astro.csp');\n}","typeGuard":"// Astro.csp is undefined when security.csp is not configured\nconst csp = Astro.csp;\nif (csp) {\n  // safe: CSP is configured\n  csp.insertDirective(/* ... */);\n}","tryCatchPattern":null,"preventionTips":["Enable security.csp in the same PR that introduces Astro.csp usage","Narrow on the API: treat Astro.csp as optional and guard with a truthiness check","Keep environment configs in sync so CSP is configured wherever the code runs"],"tags":["csp","security","config"],"backgroundTag":"feature-used-without-configuration","analyzedSha":"e294953aa8aadd98d5be92e60a03037b05dbdfd4","analyzedAt":"2026-08-18T18:48:03.901Z","contentChangedAt":"2026-08-18T18:48:03.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}