sveltejs/kit · error · Error

`content-security-policy-report-only` must be specified with

Error message

`content-security-policy-report-only` must be specified with either the `report-to` or `report-uri` directives, or both

What it means

SvelteKit's Csp class validates that a report-only Content-Security-Policy actually has somewhere to send reports. A `content-security-policy-report-only` header with directives but neither `report-to` nor `report-uri` would silently do nothing, so the constructor throws at startup. (Note: report-uri is deprecated; prefer report-to.)

Source

Thrown at packages/kit/src/runtime/server/page/csp.js:332

class CspReportOnlyProvider extends BaseProvider {
	/**
	 * @param {boolean} use_hashes
	 * @param {import('types').CspDirectives} directives
	 * @param {string} nonce
	 */
	constructor(use_hashes, directives, nonce) {
		super(use_hashes, directives, nonce);

		// If we're generating content-security-policy-report-only,
		// if there are any directives, we need a report-uri or report-to (or both)
		// else it's just an expensive noop.
		if (
			Object.values(directives).some((v) => !!v) &&
			!directives['report-to']?.length &&
			!directives['report-uri']?.length
		) {
			throw Error(
				'`content-security-policy-report-only` must be specified with either the `report-to` or `report-uri` directives, or both'
			);
		}
	}
}

export class Csp {
	/** @readonly */
	nonce = generate_nonce();

	/** @type {CspProvider} */
	csp_provider;

	/** @type {CspReportOnlyProvider} */
	report_only_provider;

	/**
	 * @param {import('./types.js').CspConfig} config

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Add a `report-to` directive (with matching report-to endpoints config) or a `report-uri` to your reportOnly directives.
2. If you don't need reporting yet, temporarily move those directives to the enforced (non-reportOnly) policy or omit them.
3. Set the directive to a falsy/empty value if you intended that directive to be disabled.
4. Test by starting the dev server — the error fires at startup, so fix before deploy.

Example fix

// before (svelte.config.js)
csp: { reportOnly: { directives: { 'default-src': ['self'] } } }
// after
csp: { reportOnly: { directives: { 'default-src': ['self'], 'report-to': ['csp-endpoint'] } } }

const d = config.kit.csp.reportOnly.directives;
if (d && Object.values(d).some(Boolean) && !d['report-to']?.length && !d['report-uri']?.length) {
  throw new Error('reportOnly CSP needs report-to or report-uri');
}

// Fail fast at config load time
try {
  new Csp({ directives: reportOnlyDirectives }, { reportOnly: true });
} catch (e) {
  console.error('Invalid CSP config:', e.message);
  process.exit(1);
}

When it happens

Trigger: Setting `csp.config.reportOnly.directives` in svelte.config.js with truthy directives (e.g. only 'default-src') but no 'report-to' or 'report-uri'; building the Csp object with reportOnly: true and an incomplete directive object.

Common situations: Copying a CSP config from the enforced policy into reportOnly without adding a reporting endpoint; enabling report-only mode to test a policy but forgetting the reporting directive; upgrading SvelteKit and the previously-tolerated config now throws.

Related errors

• The `csp.directives['trusted-types']` option must include 's
• Invalid alias key: ${key}
• Invalid alias value: ${value}
• Cannot redirect to external URL ${JSON.stringify(location)}.
• Cannot redirect to ${JSON.stringify(location)} with `{ exter

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/2544dcc4f0c836d6. Report an issue: GitHub.