django-csp-nonce 1.0.0

Disclosure

• This code has not been through a third party security audit.

• I’ve successfully tested this locally with pypy-5.4.1. TravisCI has confirmed this doesn’t work with their version.

Installation

pip install django-csp-nonce

Add DCN to MIDDLEWARE_CLASSES:

MIDDLEWARE_CLASSES = (
    [ ... ]
    'csp_nonce.middleware.CSPNonceMiddleware',
    # Make sure you put it *above* django-csp if you're using it
    [ ... ]
)

Add DCN to context_processors:

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [...],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'csp_nonce.context_processors.nonce',
                [ ... ]
            ],
        },
    },
]

Finally, add DCN directives to settings:

CSP_NONCE_SCRIPT = False  # True if you want to use it
CSP_NONCE_STYLE = False  # True if you want to use it
CSP_FLAG_STRICT = False  # True to include strict-dynamic in CSP

Usage

DCN takes care of nonce generation for you. As you work on your templates, pull in your specific nonce from the context:

<script type="text/javascript" {{ script_nonce }}>
...
</script>

<style {{ style_nonce }}>
...
</style>

Dependencies

• Django

Known issues

• Nonce sync breaks on settings.DEBUG=True

Important Changes

• 1.0

  • Out of beta!

  • PyNacl is no longer a dependency. (Moving forward the aim is to stay compatible with environments such as Google App Engine which don’t support non-python extensions.)

Running Tests

Use tox to run the tests against multiple versions of Python that you have installed and multiple versions of Django. Please make sure that you run your tests against at least Python 2.7 and Python 3.5.

virtualenv venv
. ./venv/bin/activate

pip install tox

tox