sveltejs/kit · error · Error

The `csp.directives['trusted-types']` option must include 's

Error message

The `csp.directives['trusted-types']` option must include 'sveltekit-trusted-url' when `serviceWorker.register` is true

What it means

When Trusted Types (`require-trusted-types-for: 'script'`) is enforced and the service worker is registered, SvelteKit needs the 'sveltekit-trusted-url' entry in csp.directives['trusted-types'] so its internal code can create trusted URLs for the worker. process_config throws if the combination require-trusted-types-for + serviceWorker.register + existing service worker file occurs without that policy entry, because the service worker registration would be blocked by the browser.

Source

Thrown at packages/kit/src/core/config/index.js:144

 */
export function extract_svelte_config(vite_config) {
	const plugin = vite_config.plugins.find((p) => p.name === 'vite-plugin-sveltekit-setup');
	return plugin?.api.options ?? process_config(validate_config({}), vite_config.root);
}

/**
 * @param {ValidatedConfig} config
 * @param {string} cwd
 * @returns {ValidatedConfig}
 */
export function process_config(config, cwd) {
	if (
		config.csp?.directives?.['require-trusted-types-for']?.includes('script') &&
		config.serviceWorker.register &&
		resolve_entry(path.resolve(cwd, config.files.serviceWorker)) &&
		!config.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url')
	) {
		throw new Error(
			"The `csp.directives['trusted-types']` option must include 'sveltekit-trusted-url' when `serviceWorker.register` is true"
		);
	}

	config.outDir = path.resolve(cwd, config.outDir);
	config.env.dir = path.resolve(cwd, config.env.dir);

	for (const key in config.files) {
		if (key === 'hooks') {
			config.files.hooks.client = path.resolve(cwd, config.files.hooks.client);
			config.files.hooks.server = path.resolve(cwd, config.files.hooks.server);
			config.files.hooks.universal = path.resolve(cwd, config.files.hooks.universal);
		} else if (key !== 'lib' /* TODO remove when we remove the `lib` option altogether */) {
			// @ts-expect-error
			config.files[key] = path.resolve(cwd, config.files[key]);
		}
	}

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Add 'sveltekit-trusted-url' to `kit.csp.directives['trusted-types']` in svelte.config.js.
2. Alternatively set `kit.serviceWorker.register: false` and register the worker manually if you control the policy there.
3. Alternatively remove 'script' from `require-trusted-types-for` if Trusted Types enforcement is not required.

Example fix

// before
const config = { kit: { csp: { directives: { 'require-trusted-types-for': ['script'], 'trusted-types': ['my-policy'] } } } };
// after
const config = { kit: { csp: { directives: { 'require-trusted-types-for': ['script'], 'trusted-types': ['my-policy', 'sveltekit-trusted-url'] } } } };

const kit = config.kit;
const needsTT = kit?.csp?.directives?.['require-trusted-types-for']?.includes('script');
if (needsTT && kit?.serviceWorker?.register !== false &&
    !kit?.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url')) {
  throw new Error("Add 'sveltekit-trusted-url' to kit.csp.directives['trusted-types']");
}

try {
  await viteBuild();
} catch (e) {
  if (e.message.includes('sveltekit-trusted-url')) {
    console.error('Trusted Types + service worker requires the sveltekit-trusted-url policy');
  }
  throw e;
}

When it happens

Trigger: process_config (invoked by the Vite plugin handler / extract_svelte_config) sees all of: `kit.csp.directives['require-trusted-types-for']` includes 'script', `kit.serviceWorker.register` is true, the service worker entry file resolves, and `kit.csp.directives['trusted-types']` is missing or does not list 'sveltekit-trusted-url'.

Common situations: Teams hardening apps with a strict CSP/Trusted Types policy enable require-trusted-types-for but forget the SvelteKit-specific policy name; copying a generic CSP config from another framework.

Related errors

• Cannot use prerendering if config.csp.mode === "nonce"
• [SvelteKit] ${error.message}
• `content-security-policy-report-only` must be specified with
• The _headers file should be placed in the project root rathe
• The _redirects file should be placed in the project root rat

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/35a44fbf42ec9c90. Report an issue: GitHub.