Is Svelte5 with static generator supposed to be complete ?

[mulder999]

Hello,

I am currently migrating a static website built with Svelte 4 to Svelte 5. However, I am encountering numerous issues related to Content Security Policy (CSP). Given these challenges, I am concerned about the level of support for CSP in Svelte 5.

Could anyone provide confirmation on the following:

• CSP Compatibility: Are there known issues with CSP in Svelte 5 that I should be aware of?
• Documentation: Is there updated documentation or best practices for configuring CSP with Svelte 5?

[eltigerchino]

Hi Mulder, do you have a minimal reproduction that can reproduce these CSP issues?

[mulder999]

@eltigerchino please find a minimal reproduction attempt here

This is basically the standard sveltekit demo and adjustment were made in commit 92df14f (static adapter + CSP).

To reproduce:

1. npm run build
2. npm run preview
3. Open project home page and start the browser console
4. Reload page -> csp style issue
5. Click on a button -> more csp style issue

On my large project, I also have inline scripts issues but this seems not visible with this minimalistic project.
With svelte4 using "self" and "blob:" for script-src were enough.

[eltigerchino]

Thank you. I've created a new issue to track this https://github.com/sveltejs/kit/issues/12884