From 1093e3f43e49198860f09b5fd97916d8566b93e7 Mon Sep 17 00:00:00 2001
From: raamas <omardenilson007@gmail.com>
Date: Mon, 2 Mar 2026 08:10:49 -0500
Subject: [PATCH] docs: add Content Security Policy (CSP) documentation

---
 documentation/docs/06-runtime/06-csp.md | 60 +++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 documentation/docs/06-runtime/06-csp.md

diff --git a/documentation/docs/06-runtime/06-csp.md b/documentation/docs/06-runtime/06-csp.md
new file mode 100644
index 0000000000..d826c6007b
--- /dev/null
+++ b/documentation/docs/06-runtime/06-csp.md
@@ -0,0 +1,60 @@
+---
+title: Content Security Policy (CSP)
+---
+
+
+`hydratable` adds an inline `<script>` block to the `head` returned from `render`. If you're using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (CSP), this script will likely fail to run. You can provide a `nonce` to `render`:
+
+```js
+/// file: server.js
+import { render } from 'svelte/server';
+import App from './App.svelte';
+// ---cut---
+const nonce = crypto.randomUUID();
+
+const { head, body } = await render(App, {
+	csp: { nonce }
+});
+```
+
+This will add the `nonce` to the script block, on the assumption that you will later add the same nonce to the CSP header of the document that contains it:
+
+```js
+/// file: server.js
+let response = new Response();
+let nonce = 'xyz123';
+// ---cut---
+response.headers.set(
+  'Content-Security-Policy',
+  `script-src 'nonce-${nonce}'`
+ );
+```
+
+It's essential that a `nonce` — which, British slang definition aside, means 'number used once' — is only used when dynamically server rendering an individual response.
+
+If instead you are generating static HTML ahead of time, you must use hashes instead:
+
+```js
+/// file: server.js
+import { render } from 'svelte/server';
+import App from './App.svelte';
+// ---cut---
+const { head, body, hashes } = await render(App, {
+	csp: { hash: true }
+});
+```
+
+`hashes.script` will be an array of strings like `["sha256-abcd123"]`. As with `nonce`, the hashes should be used in your CSP header:
+
+```js
+/// file: server.js
+let response = new Response();
+let hashes = { script: ['sha256-xyz123'] };
+// ---cut---
+response.headers.set(
+  'Content-Security-Policy',
+  `script-src ${hashes.script.map((hash) => `'${hash}'`).join(' ')}`
+ );
+```
+
+We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future.
\ No newline at end of file