serialization.mdx

title	Serialization
use_cases	server function payloads, data transfer, csp, security, performance
tags	serialization server-functions csp security performance
version	1.0
description	Understand how SolidStart serializes server function payloads, supported types, and CSP tradeoffs.

SolidStart serializes server function arguments and return values so they can travel between server and client. It uses Seroval under the hood and streams payloads to keep responses responsive.

Configuration

Configure serialization in your app.config.ts with defineConfig:

import { defineConfig } from "@solidjs/start/config";

export default defineConfig({
	serialization: {
		mode: "js",
	},
});

import { defineConfig } from "vite";
import { solidStart } from "@solidjs/start";

export default defineConfig({
	plugins: [
		solidStart({
			serialization: {
				mode: "json",
			},
		}),
	],
});

See the full config reference in defineConfig.

Modes

• json: Uses JSON.parse on the client. Best for strict CSP because it avoids eval. Payloads can be slightly larger.
• js: Uses Seroval's JS serializer for smaller payloads and better performance, but it requires unsafe-eval in CSP.

:::caution[v2 Breaking Change: Defaults] SolidStart v1 defaults to js for backwards compatibility. SolidStart v2 defaults to json for CSP compatibility. :::

Supported types (default)

SolidStart enables Seroval plus a default set of web platform plugins. These plugins add support for:

• AbortSignal, CustomEvent, DOMException, Event
• FormData, Headers, ReadableStream
• Request, Response
• URL, URLSearchParams

Seroval supports additional value types. The compatibility list is broader than what SolidStart enables by default, so treat it as a superset. See the Seroval compatibility docs.

Server function payloads (v1 vs v2)

SolidStart applies extra handling for certain payload types so file uploads and binary data can flow without being serialized by Seroval.

In v1, only FormData is treated this way, and only when it is the single argument passed to a server function. This allows file uploads to work without Seroval serialization.

In v2, this behavior is expanded and applies to both server function arguments and return values. SolidStart bypasses Seroval for:

• FormData
• URLSearchParams
• Uint8Array
• ArrayBuffer
• Blob
• File
• string

Because these values are transferred directly, v2 can yield smaller payloads for these cases.

Limits and exclusions

• RegExp is disabled by default.
• JSON mode enforces a maximum serialization depth of 64. If you exceed this, flatten the structure or return a simpler payload.

Related guidance

• Configure modes and defaults in defineConfig.
• CSP implications and nonce examples live in the Security guide.