From a71b35d35d8fcefe63a3a65eff7acf5779806d66 Mon Sep 17 00:00:00 2001
From: Omar Cordoba <53019698+raamas@users.noreply.github.com>
Date: Mon, 2 Mar 2026 07:57:07 -0500
Subject: [PATCH] Remove CSP section from hydratable documentation

Removed the section on CSP and nonce usage for hydratable scripts, including code examples for both nonce and hash methods.
---
 .../docs/06-runtime/05-hydratable.md          | 58 -------------------
 1 file changed, 58 deletions(-)

diff --git a/documentation/docs/06-runtime/05-hydratable.md b/documentation/docs/06-runtime/05-hydratable.md
index f8d5130581..a5302f264d 100644
--- a/documentation/docs/06-runtime/05-hydratable.md
+++ b/documentation/docs/06-runtime/05-hydratable.md
@@ -63,61 +63,3 @@ All data returned from a `hydratable` function must be serializable. But this do
 {await promises.one}
 {await promises.two}
 ```
-
-## CSP
-
-`hydratable` adds an inline `<script>` block to the `head` returned from `render`. If you're using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (CSP), this script will likely fail to run. You can provide a `nonce` to `render`:
-
-```js
-/// file: server.js
-import { render } from 'svelte/server';
-import App from './App.svelte';
-// ---cut---
-const nonce = crypto.randomUUID();
-
-const { head, body } = await render(App, {
-	csp: { nonce }
-});
-```
-
-This will add the `nonce` to the script block, on the assumption that you will later add the same nonce to the CSP header of the document that contains it:
-
-```js
-/// file: server.js
-let response = new Response();
-let nonce = 'xyz123';
-// ---cut---
-response.headers.set(
-  'Content-Security-Policy',
-  `script-src 'nonce-${nonce}'`
- );
-```
-
-It's essential that a `nonce` — which, British slang definition aside, means 'number used once' — is only used when dynamically server rendering an individual response.
-
-If instead you are generating static HTML ahead of time, you must use hashes instead:
-
-```js
-/// file: server.js
-import { render } from 'svelte/server';
-import App from './App.svelte';
-// ---cut---
-const { head, body, hashes } = await render(App, {
-	csp: { hash: true }
-});
-```
-
-`hashes.script` will be an array of strings like `["sha256-abcd123"]`. As with `nonce`, the hashes should be used in your CSP header:
-
-```js
-/// file: server.js
-let response = new Response();
-let hashes = { script: ['sha256-xyz123'] };
-// ---cut---
-response.headers.set(
-  'Content-Security-Policy',
-  `script-src ${hashes.script.map((hash) => `'${hash}'`).join(' ')}`
- );
-```
-
-We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future.