sveltejs/kit · error · Error

Cannot use prerendering if config.csp.mode === "nonce"

Error message

Cannot use prerendering if config.csp.mode === "nonce"

What it means

Nonce-based CSP (`csp.mode === 'nonce'`) requires a unique nonce per response, which conflicts with prerendering, where a single HTML file is generated once and served many times. SvelteKit throws at render time to prevent serving pages with a reused or invalid nonce.

Source

Thrown at packages/kit/src/runtime/server/page/render.js:65

 *   error_components?: Array<import('svelte').Component | undefined>
 * }} opts
 */
export async function render_response({
	branch,
	fetched,
	page_config,
	status,
	error = null,
	event,
	state,
	resolve_opts,
	action_result,
	data_serializer,
	error_components
}) {
	if (state.prerendering || state.prerender_default === true) {
		if (options.csp.mode === 'nonce') {
			throw new Error('Cannot use prerendering if config.csp.mode === "nonce"');
		}

		if (options.app_template_contains_nonce) {
			throw new Error('Cannot use prerendering if page template contains %sveltekit.nonce%');
		}
	}

	const client = manifest.client;

	const modulepreloads = new Set(client?.imports);
	const stylesheets = new Set(client?.stylesheets);

	/** @type {Map<string, import('types').FontDependency>} */
	const fonts = new Map(client?.fonts.map((font) => [font.file, font]));

	/**
	 * The value of the Link header that is added to the response when not prerendering
	 * @type {Set<string>}

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Set `kit.csp.mode` to 'hash' or 'auto' instead of 'nonce' in svelte.config.js
2. Disable prerendering for the affected pages (`export const prerender = false`)
3. If hashes suffice, use hash-mode CSP which is compatible with static output

Example fix

// before (svelte.config.js)
csp: { mode: 'nonce' }
// after
csp: { mode: 'hash' }

// validate config before build
if (config.kit.csp.mode === 'nonce' && pages.some((p) => p.prerender)) {
  throw new Error('csp nonce is incompatible with prerendering');
}

When it happens

Trigger: `svelte.config.js` sets `kit.csp.mode: 'nonce'` while a page is prerendered (`export const prerender = true`, `prerender` entries, or `prerender_default === true`) and `render_response` runs during the prerender build.

Common situations: Enabling nonce CSP for security hardening while prerender entries exist; adding prerender = true to a landing page in an app that already uses nonce CSP; running `vite build` with the adapter's prerender pass.

Related errors

• The `csp.directives['trusted-types']` option must include 's
• Cannot use prerendering if page template contains %sveltekit
• [SvelteKit] ${error.message}
• The _headers file should be placed in the project root rathe
• The _redirects file should be placed in the project root rat

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/cf3cb7d8189a8a6d. Report an issue: GitHub.