fix: don't disable CSRF protection in builds with a non-production NODE_ENV

[Nic-Polumeyv]

The NODE_ENV saga continues. Any build where NODE_ENV isn't production currently ships with every origin check compiled out:

// respond.js
if (!DEV) {
	// cross-site remote request check
	// cross-site form submission check (csrf.checkOrigin / trustedOrigins)
}

DEV comes from esm-env, which kit bundles into apps resolved by NODE_ENV, so NODE_ENV=staging vite build produces a deployable server with CSRF protection silently disabled. Vite's docs list non-production builds as a supported workflow, and khromov raised this exact failure mode in #14335 when the gate was added. At the time DEV was assumed to only mean vite dev, which the esm-env consolidation in #14308 no longer guarantees (first leak #15632, fixed by #15852, second leak #16008, fixed by #16023).

This applies the rule from the #15852 body ("reverting to the global constant where we want the code to only run during vite dev ... Every other place that uses DEV is meant to fire warnings ... and that should still happen if the user did NODE_ENV=development vite build") to two sites it missed:

• the respond.js gate, !DEV to !__SVELTEKIT_DEV__, covering both the form CSRF check and the remote functions origin check that now shares it
• the live-serving condition in app/server/remote/prerender.js, same one-token swap (prerendered remote functions were served live in these builds)

The three validation DEV sites in respond.js (validateHeaders, page_nodes.validate(), validate_server_exports) are deliberately untouched. They are warning sites and should keep following NODE_ENV per the rule. The check internals are also untouched, so this stays out of the way of the sec-fetch-site idea in #15992.

The new spec in test/build-errors builds a minimal fixture with NODE_ENV=staging, imports the generated server, and asserts a normal GET returns 200 while a forged cross-site form POST returns 403. It fails on main (the POST returns 200) and passes with the fix. The existing basics CSRF tests stay green in both modes, and dev behavior is unchanged.

There are HMR-coupled DEV gates in client.js and the remote query modules from the same class. Left for a follow-up, client.js currently conflicts with #16307.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 67459fe:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/67459fedcb0f782779b3c84514e84f612fd1a7f2

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16313

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 67459fe

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[teemingc]

Thanks!