This release is a pre-release and may not be stable for production use.
django-simple-csp
A simple Middleware for adding CSP headers and nonces in Django
Usage
Requires Django >=1.10
Add it to the INSTALLED_APPS settings variable:
INSTALLED_APPS = [
...
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
...
'django_simple_csp'
...
]
Add it to MIDDLEWARE (not MIDDLEWARE_CLASSES):
MIDDLEWARE = [
...
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
...
'django-simple-csp.middleware.csp.CSPMiddleware',
...
]
CSS
Hashes
Example use of hashed inline style:
{% load csp %}
{% csp_css_hash %}
td.style-class {
background-color: red;
}
{% end_csp_css_hash %}
usage inside of style=”…” attributes is not supported by chromium for now.
Nonces
Example:
{% load csp %}
<style nonce={% csp_css_nonce %}>
td.style-class {
background-color: red;
}
</style>
Javascript
Nonces
TODO: Change to hashes?
Example:
{% load csp %}
<script nonce={% csp_js_nonce %}>
alert("bla")
</script>
Config Values
CSP_REPORT_URL = “” The URl CSP errors should be reported to, set to “” if not used, or do not define it.
CSP_REPORT_ONLY = True Set the header to just report CSP errors do not enforce the CSP. Defaults to True.
CSP_ADDITIONAL_SCRIPT_SRC = [] List of additional hosts javascript is allowed to be loaded from
CSP_ADDITIONAL_STYLE_SRC = [] List of additional hosts CSS is allowed to be loaded from
CSP_ADDITIONAL_IMG_SRC = [] List of additional hosts images is allowed to be loaded from
CSP_ADDITIONAL_DEFAULT_SRC = [] List of additional hosts all other resources are allowed to be loaded from
Upgrades
From < 0.3
‘django-simple-csp’ has to be changed into ‘django_simple_csp’ in th INSTALLED_APPS in Django settings.py
2 maintainers
Metadata
2 maintainers
Release files for django-simple-csp 0.5.dev1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| django_simple_csp-0.5.dev1.tar.gz | 4.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| django_simple_csp-0.5.dev1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 9.1 kB
Release files / django_simple_csp-0.5.dev1.tar.gz
| Download URL | django_simple_csp-0.5.dev1.tar.gz |
|---|---|
| Size | 4.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ea302e882303189a61736c83260b79594c8d8cf7a9c765d12afef6320df9aaed
|
|
BLAKE2b-256 checksum How to use checksums |
23f4343e43f52f2114ee0c73f4d525f3a3a08b7e13eb97475ad9804cc8c4fdb8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.7.19
|
Release files / django_simple_csp-0.5.dev1-py3-none-any.whl
| Download URL | django_simple_csp-0.5.dev1-py3-none-any.whl |
|---|---|
| Size | 5.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
015e0c058d4d72a71e6e0e6c3b1cbf4385795b52e096bce04b16856288c8438a
|
|
BLAKE2b-256 checksum How to use checksums |
3aba56e9d0258f26bbf96f877ca0f3afcdc6e4399d3e21083dbeda0be8a449d3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.7.19
|
