Blog

In this tutorial you will learn how to handle client side auth routes in SPA mode with the correct security assumptions.

+layout.svelte wraps every child page and stays mounted on navigation. Build a nested account layout with load data, then a route group so login skips the shop nav.

goto() is client-side navigation from a click handler. Use an <a> when you already know the href, and redirect() when the server should send a 3xx.

Build a multi-stage image with adapter-node, set ORIGIN, and run the Node server in a container.

Build a SvelteKit app with adapter-node, copy it to a t3a.small, then PM2, nginx, and TLS.

Extract a ProductCard.svelte, pass props with $props, and reuse it on the product list and the [slug] page.

redirect() throws a 3xx. Call it from load, an action, or hooks, and do not catch it.

Add Tailwind v4 to a SvelteKit app with the Vite plugin, then style a layout and a product card.

How SvelteKit maps folders to URLs. Build static pages, a layout, a [slug] product page, a catch-all help section, and a JSON endpoint.

Replace writable with $state, a .svelte.ts class, and context. Covers the SvelteKit SSR leak that a global store still has.

Read secrets from .env with $env/static/private so they never ship to the browser. PUBLIC_ names, static vs dynamic, and the SvelteKit 3 rename.

Create a SvelteKit app and build a reading list. Covers routes, a layout, load, and a form action.

Connect Drizzle ORM to a local SQLite file in a SvelteKit app, push a schema, and build a notes form that writes to the database.

Connect Drizzle ORM to PostgreSQL in a SvelteKit app, push a schema, and build a notes form that writes to the database.

use:enhance and fetch do not report how many bytes have left the browser. Post the file with XMLHttpRequest and update a progress bar from upload.onprogress.

file.type and the filename are claims from the browser. Read the first bytes of the upload in SvelteKit and keep only JPEG, PNG, or WebP.

Form actions hit body size limits. Sign a short-lived S3 PUT URL on the server and let the browser send the file straight to the bucket.

A UUID in the URL is not a lock. Check the session on the GET that returns the bytes, record who owns the file, and keep shared caches from storing it.

Build a SvelteKit form that uploads an image, validates it on the server, saves it, and serves it back. Covers multipart forms, body size limits, and why static hosting cannot do this alone.

Upgrade a SvelteKit 2 app to SvelteKit 3. Config moves into Vite, $lib becomes #lib, $app/stores is gone, and a handful of security defaults get stricter.

A step by step guide to add cookie based login to a SvelteKit app using hooks.server.ts, form actions and an HttpOnly session cookie.

We replaced Preline JS with Bits UI on this site and measured it. The home page shipped 42% fewer bytes, and a surprising chunk of the win had nothing to do with JavaScript.