Serving uploaded files behind auth in SvelteKit
A UUID in the URL is not a lock. Check the session on the GET that returns the bytes, record who owns the file, and keep shared caches from storing it.
Uploading files in a SvelteKit web app
Build a SvelteKit form that uploads an image, validates it on the server, saves it, and serves it back. Covers multipart forms, body size limits, and why static hosting cannot do this alone.
SvelteKit 3 changelog and migration guide
Upgrade a SvelteKit 2 app to SvelteKit 3. Config moves into Vite, $lib becomes #lib, $app/stores is gone, and a handful of security defaults get stricter.
SvelteKit auth with HttpOnly cookies
A step by step guide to add cookie based login to a SvelteKit app using hooks.server.ts, form actions and an HttpOnly session cookie.
What a global UI script costs your SvelteKit app
We replaced Preline JS with Bits UI on this site and measured it. The home page shipped 42% fewer bytes, and a surprising chunk of the win had nothing to do with JavaScript.
Sveltekit Protected Routes in SPA mode
In this tutorial you will learn how to handle client side auth routes in SPA mode with the correct security assumptions.