https://csp-guide.com/tags/api/ Recent content in Api on CSP Guide Hugo -- gohugo.io en-us Tue, 28 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-api-routes-in-sveltekit/ Tue, 28 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-api-routes-in-sveltekit/ <p>SvelteKit makes CSP pretty nice for pages, but API routes are where people get sloppy.</p> <p>I see this a lot: a team carefully sets <code>kit.csp</code> for HTML pages, then their <code>/api/*</code> endpoints return JSON with no security headers at all. That is usually fine for <code>script-src</code> and friends — browsers don’t execute JSON as a document — but API routes still matter for CSP in a few real cases:</p> <ul> <li>an endpoint returns HTML, SVG, PDF, or other renderable content</li> <li>an endpoint is used as a file download</li> <li>an endpoint serves inline bootstrapped JS or config</li> <li>you want a consistent policy surface across the app</li> <li>you need to control embedding with <code>frame-ancestors</code></li> <li>you’re debugging weird browser behavior around MIME sniffing and resource loading</li> </ul> <p>So the short version is this:</p>