django-integrity-policy 1.0.0

Set the Integrity-Policy HTTP header on your Django app.

---

Set the Integrity-Policy HTTP header on your Django app.

---

Work smarter and faster with my book Boost Your Django DX which covers many ways to improve your development experience.

---

Requirements

Python 3.10 to 3.14 supported.

Django 4.2 to 6.0 supported.

Installation

1. Install with pip:

python -m pip install django-integrity-policy

2. Add the middleware in your MIDDLEWARE setting. It’s best to add it after Django’s SecurityMiddleware, so it adds the header at the same point in your stack:

MIDDLEWARE = [
    ...,
    "django.middleware.security.SecurityMiddleware",
    "django_integrity_policy.IntegrityPolicyMiddleware",
    ...,
]

3. Add an INTEGRITY_POLICY or INTEGRITY_POLICY_REPORT_ONLY setting to your settings file. Here’s an example that blocks scripts and stylesheets that lack integrity metadata:

   INTEGRITY_POLICY = {
       "blocked-destinations": ["script", "style"],
   }

   See below for more information on the settings.

Settings

The integrity policy for your page is configured with two settings:

• INTEGRITY_POLICY - sets the Integrity-Policy header, which defines the policy that the browser enforces.

• INTEGRITY_POLICY_REPORT_ONLY - sets the Integrity-Policy-Report-Only header, which defines a policy that the browser simulates but does not enforce.

In both cases, any violations are reported to the console and optionally to a reporting endpoint defined by the Reporting-Endpoints header. The report-only header is useful for testing a new policy before enforcing it.

Each setting should be a dictionary with the following keys:

• blocked-destinations (required) - a list of request destinations that must include valid integrity metadata. Allowed values are 'script' and 'style'.

• sources (optional) - a list of integrity metadata sources. The only allowed value is 'inline', which is also the default when sources is omitted.

• endpoints (optional) - a list of reporting endpoint names to send violation reports to. The named endpoints must be defined in a Reporting-Endpoints response header.

If the keys or values are invalid, ImproperlyConfigured will be raised at instantiation time.

Examples

Block scripts and styles that lack integrity metadata:

INTEGRITY_POLICY = {
    "blocked-destinations": ["script", "style"],
}

Block scripts and report violations to a named endpoint:

INTEGRITY_POLICY = {
    "blocked-destinations": ["script"],
    "endpoints": ["integrity-endpoint"],
}

Test the effect of blocking scripts without enforcing it:

INTEGRITY_POLICY_REPORT_ONLY = {
    "blocked-destinations": ["script"],
    "endpoints": ["integrity-endpoint"],
}