SvelteKit hooks.server utilities

Dependency free* and reusable functions for:

• enabling or disabling HTTP basic authentication on server level;
• setting route-based cache control rules
• setting common header responses for security purposes

*Node is still required for crypto.

Please note: these are personal utilities, tested on SvelteKit projects only, not published npm packages.

Installation

Each handle is a single, independent file. Copy only the ones needed into src/lib/server/, then handle them in hooks.server.ts (examples below).

basicAuth

Adds HTTP Basic Auth, useful for protecting staging/preview deployments, also useful for demos.

File: src/lib/server/basicAuth.ts

Usage:

import { createBasicAuthHandle } from '$lib/server/basicAuth';
import { env } from '$env/dynamic/private';

createBasicAuthHandle({
  enabled: env.ENABLE_BASIC_AUTH === 'true',
  username: env.BASIC_AUTH_USER,
  password: env.BASIC_AUTH_PASS,
  bypassPrefixes: ['/route'] // optional
});

By default, everything is protected except bypassPrefixes.

To protect only specific routes instead, use protectPrefixes (allow-list). This takes priority over bypassPrefixes when both are set.

Protection cascades to sub-paths: protecting /page also protects /page/subpage. Protecting / protects the entire site.

createBasicAuthHandle({
  enabled: env.ENABLE_BASIC_AUTH === 'true',
  username: env.BASIC_AUTH_USER,
  password: env.BASIC_AUTH_PASS,
  protectPrefixes: ['/admin'] // only /admin and its sub-paths are protected
});

Required env vars:

ENABLE_BASIC_AUTH=bool
BASIC_AUTH_USER=user
BASIC_AUTH_PASS=password

---

securityHeaders

Applies common security-related HTTP headers to every response (X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS in production, etc).

File: src/lib/server/securityHeaders.ts

Usage:

import { createSecurityHeadersHandle } from '$lib/server/securityHeaders';
import { env } from '$env/dynamic/private';

createSecurityHeadersHandle({
  isProduction: env.NODE_ENV === 'production'
});

---

cacheControl

Sets Cache-Control headers per route, based on configurable prefix rules.

maxAge accepts a plain number of seconds, or the seconds, minutes, hours, and days helpers for better readability.

File: src/lib/server/cacheControl.ts

Usage:

import { createCacheControlHandle, hours, days } from '$lib/server/cacheControl';

createCacheControlHandle({
  rules: [ //optional
    { prefix: '/sitemap.xml', maxAge: days(1) },
    { prefix: '/customCachedPath/', maxAge: hours(2) },
    { prefix: '/pathInt/', maxAge: 3600 }
  ],
  excludePrefixes: ['/admin', '/auth', '/private-routes'], //optional
  defaultMaxAge: hours(1)
});

---

Combining handles

// src/hooks.server.ts
import type { Handle } from '@sveltejs/kit';
import { sequence } from '@sveltejs/kit/hooks';
import { env } from '$env/dynamic/private';

import { createBasicAuthHandle } from '$lib/server/basicAuth';
import { createSecurityHeadersHandle } from '$lib/server/securityHeaders';
import { createCacheControlHandle } from '$lib/server/cacheControl'; 


export const handle: Handle = sequence(
  createSecurityHeadersHandle({ isProduction: env.NODE_ENV === 'production' }),
  createCacheControlHandle({ /* ... */ }),
  createBasicAuthHandle({ /* ... */ })
);