django-simple-csp

Pre-release

This release is a pre-release and may not be stable for production use.

django-simple-csp

A simple Middleware for adding CSP headers and nonces in Django

Usage

Requires Django >=1.10

Add it to the INSTALLED_APPS settings variable:

INSTALLED_APPS = [
    ...
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    ...
    'django_simple_csp'
    ...
]

Add it to MIDDLEWARE (not MIDDLEWARE_CLASSES):

MIDDLEWARE = [
    ...
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    ...
    'django-simple-csp.middleware.csp.CSPMiddleware',
    ...
]

CSS

TODO: remove hash from the name of tag?

Example use of hashed inline style:

{% load csp %}
{% csp_css_hash %}
    td.style-class {
        background-color: red;
    }
{% end_csp_css_hash %}

usage inside of style=”…” attributes is not supported by chromium for now.

Javascript

Nonces

TODO: Change to hashes?

Example:

{% load csp %}
<script nonce={% csp_js_nonce %}>
    alert("bla")
</script>

Config Values

CSP_REPORT_URL = “” The URl CSP errors should be reported to, set to “” if not used, or do not define it.

CSP_REPORT_ONLY = True Set the header to just report CSP errors do not enforce the CSP. Defaults to True.

CSP_ADDITIONAL_SCRIPT_SRC = [] List of additional hosts javascript is allowed to be loaded from

CSP_ADDITIONAL_STYLE_SRC = [] List of additional hosts CSS is allowed to be loaded from

CSP_ADDITIONAL_IMG_SRC = [] List of additional hosts images is allowed to be loaded from

Upgrades

From < 0.3

‘django-simple-csp’ has to be changed into ‘django_simple_csp’ in th INSTALLED_APPS in Django settings.py

Release files for django-simple-csp 0.3.dev1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for django-simple-csp 0.3.dev1
File	Size	Uploaded
django-simple-csp-0.3.dev1.tar.gz	4.3 kB	May 6, 2022	Details

Built distribution (wheel)

Table of built distributions (wheels) for django-simple-csp 0.3.dev1
File	Interpreter	ABI	Platform	Reset
django_simple_csp-0.3.dev1-py3-none-any.whl 8.7 kB May 6, 2022	Python 3	none	any	Details

Total release size: 13.0 kB

Release files / django-simple-csp-0.3.dev1.tar.gz

Download URL	django-simple-csp-0.3.dev1.tar.gz
Size	4.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`fbb67d73645bb1c7af3b0295b0edcf0a4f934d6edce3d96505f1041376ddeea8`
BLAKE2b-256 checksum How to use checksums	`aa1700c8933e9beae61e4bfcbe3b36c7452547297a498f124939c4034bfdf378`
Upload date	May 6, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`

Release files / django_simple_csp-0.3.dev1-py3-none-any.whl

Download URL	django_simple_csp-0.3.dev1-py3-none-any.whl
Size	8.7 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`d17ee2a0267a0ad08a0ad2ad6bbfe734328391570343e46014080ca9c512c866`
BLAKE2b-256 checksum How to use checksums	`2df99fcab7a8f740149c2403c1f5f44f927c25caea73232187419dae9b9df198`
Upload date	May 6, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`