sveltejs/kit · warning

[SvelteKit] ${error.message}

Error message

[SvelteKit] ${error.message}

What it means

SvelteKit validates configured headers (e.g. in the server config used for responses/prerender) against a table of per-header validators. If a validator throws, the invalid value is warned about rather than crashing the build/server. The warning is prefixed with `[SvelteKit]` and shows the underlying validation error message.

Source

Thrown at packages/kit/src/runtime/server/validate-headers.js:60

		const type = value.split(';')[0].trim();
		const error_suffix = `(While parsing "${value}".)`;
		if (!CONTENT_TYPE_PATTERN.test(type)) {
			throw new Error(`Invalid content-type value "${type}". ${error_suffix}`);
		}
	}
};

/**
 * @param {Record<string, string>} headers
 */
export function validateHeaders(headers) {
	for (const [key, value] of Object.entries(headers)) {
		const validator = HEADER_VALIDATORS[key.toLowerCase()];
		try {
			validator?.(value);
		} catch (error) {
			if (error instanceof Error) {
				console.warn(`[SvelteKit] ${error.message}`);
			}
		}
	}
}

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Read the message after `[SvelteKit]` to identify the offending header and fix its value
2. Validate CSP with a linter or the CSP evaluator before deploying
3. Wrap risky dynamic header construction in validation/tests

Example fix

// before
headers: { 'content-security-policy': "default-src 'self'; script-src 'self' 'inlin-scripts'" }
// after
headers: { 'content-security-policy': "default-src 'self'; script-src 'self'" }

const RISKY = ['content-security-policy', 'link'];
for (const [k, v] of Object.entries(headers)) {
  if (RISKY.includes(k.toLowerCase()) && typeof v !== 'string') {
    throw new TypeError(`Header ${k} must be a string`);
  }
}

When it happens

Trigger: A header value set in svelte.config.js or generated by the server fails its validator — e.g. malformed `content-security-policy` directives, invalid `link`/`reload` header syntax — passed through `Object.entries(headers)` in validate-headers.js.

Common situations: Hand-written CSP strings with typos or unsupported directives; copying header config from another framework; automated config generation producing invalid header syntax.

Related errors

• Invalid isr.expiration value: ${JSON.stringify(value)} (${de
• The `csp.directives['trusted-types']` option must include 's
• The SvelteKit options from the Vite config must be an object
• ${keypath} should be "fail", "warn", "ignore" or a custom fu
• The SvelteKit Vite plugin ${keypath} should be an object wit

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/a3a06ec1f9795195. Report an issue: GitHub.