django-integrity-policy 1.2.0

Middleware arguments

IntegrityPolicyMiddleware also accepts two keyword-only arguments, which take precedence over the equivalent settings:

• policy - a dictionary in the same format as the INTEGRITY_POLICY setting.

• report_only_policy - a dictionary in the same format as the INTEGRITY_POLICY_REPORT_ONLY setting.

When an argument is None (the default), the corresponding setting is used, and changes to it (such as with override_settings() in tests) take effect. When an argument is given, the setting is ignored for that instance, and the header value is computed and validated at instantiation time. Note that an empty dictionary ({}) is a value meaning “send no header”, which is different to None meaning “use the setting”.

Django only ever instantiates middleware with get_response, so these arguments are for when you construct instances yourself, such as within another middleware that dispatches between several instances.

Examples

Block scripts and styles that lack integrity metadata:

INTEGRITY_POLICY = {
    "blocked-destinations": ["script", "style"],
}

Block scripts and report violations to a named endpoint:

INTEGRITY_POLICY = {
    "blocked-destinations": ["script"],
    "endpoints": ["integrity-endpoint"],
}

Test the effect of blocking scripts without enforcing it:

INTEGRITY_POLICY_REPORT_ONLY = {
    "blocked-destinations": ["script"],
    "endpoints": ["integrity-endpoint"],
}

integrity_policy_override(config)

Overrides the Integrity-Policy header for the decorated view, using a dictionary in the same format as the INTEGRITY_POLICY setting.

If config is an empty mapping ({}), no Integrity-Policy header will be added to the response for that view.

For example, to block integrity-free scripts but not styles on a particular view:

from django.shortcuts import render
from django_integrity_policy.decorators import integrity_policy_override


@integrity_policy_override(
    {
        "blocked-destinations": ["script"],
    }
)
def drawbridge_view(request):
    return render(request, "castle/drawbridge.html")

…or, to not set an integrity policy at all on a particular view:

from django.shortcuts import render
from django_integrity_policy.decorators import integrity_policy_override


@integrity_policy_override({})
def dungeon_view(request):
    return render(request, "castle/dungeon.html")

integrity_policy_report_only_override(config)

Overrides the Integrity-Policy-Report-Only header for the decorated view, using a dictionary in the same format as the INTEGRITY_POLICY_REPORT_ONLY setting.

If config is an empty mapping ({}), no Integrity-Policy-Report-Only header will be added to the response for that view.

For example, to test a policy that blocks integrity-free scripts and styles for a particular view:

from django.shortcuts import render
from django_integrity_policy.decorators import integrity_policy_report_only_override


@integrity_policy_report_only_override(
    {
        "blocked-destinations": ["script", "style"],
        "endpoints": ["integrity-endpoint"],
    }
)
def gatehouse_view(request):
    return render(request, "castle/gatehouse.html")

…or, to not set a report-only integrity policy at all on a particular view:

from django.shortcuts import render
from django_integrity_policy.decorators import integrity_policy_report_only_override


@integrity_policy_report_only_override({})
def moat_view(request):
    return render(request, "castle/moat.html")