Description

I propose adding a feature to SvelteKit that allows users to easily implement Content Security Policies (CSP) directly within the SvelteKit configuration file (svelte.config.js). Currently, setting up a CSP requires manual configuration or external scripts. However, integrating CSP options into SvelteKit's configuration can simplify the process, making web applications more secure by default.

Suggested Implementation:

// In svelte.config.js
const config = {
  kit: {
    // Existing configurations...
    csp: {
      mode: 'hash', // options: 'auto', 'hash', 'nonce'
      directives: {
        'default-src': ['self'],
        'script-src': ['self', 'https://trusted-source.com'],
        // Other directives...
      }
    }
  }
};

This feature would allow developers to define CSP directives that align with their application's needs. The mode property can offer flexibility in how CSPs are handled (e.g., using 'hash' for inline scripts/styles).

Category

• New Feature

References

• SvelteKit Configuration Documentation: SvelteKit Docs
• Example Implementation: I found a GitHub repository that implements CSP directives for SvelteKit, which could serve as a reference for this feature: sveltekit-content-security-policy.