more.content-security

more.content_security

Content Security Policy for Morepath

Usage

To protect all views with a default content security policy:

from morepath import App
from more.content_security import ContentSecurityApp
from more.content_security import ContentSecurityPolicy
from more.content_security import SELF

class MyApp(App, ContentSecurityApp):
    pass

@MyApp.setting('content_security_policy', 'default')
def default_policy():
    return ContentSecurityPolicy(
        default_src={SELF},
        script_src={SELF, 'https://analytics.example.org'}
    )

To extend the default policy for the default view of a model:

@MyApp.view(model=Document)
def view_document(self, request):

    # the actual default policy is not modified here!
    request.content_security_policy.script_src.add('https://cdnjs.com')

    ....

We can also use a completely different policy:

@MyApp.view(model=Document)
def view_document(self, request):
    request.content_security_policy = ContentSecurityPolicy()

Additionally, we can use nonces in inline scripty/stylesheets. Those will automatically be added to the ‘script-src’, ‘style-src’ directives:

@MyApp.html(model=Document)
def view_document(self, request):
    return """
        <html>
            ...

            <script nonce="{}">...</script>
        </html>
    """.format(request.content_security_policy_nonce('script'))

Note that we use a custom request class for nonces. If you have your own, you need to extend it as follows:

from morepath.request import Request
from more.content_security import ContentSecurityRequest

class CustomRequest(Request, ContentSecurityRequest):
    pass

class MyApp(App, ContentSecurityApp):
    request_class = CustomRequest

To only use the ‘Content-Security-Policy-Report-Only’ header, use this:

@MyApp.setting('content_security_policy', 'default')
def default_policy():
    return ContentSecurityPolicy(
        report_only=True,
        default_src={SELF}
    )

Run the Tests

Install tox and run it:

pip install tox
tox

Limit the tests to a specific python version:

tox -e py27

Conventions

more.content_security follows PEP8 as close as possible. To test for it run:

tox -e pep8

more.content_security uses Semantic Versioning

License

more.content_security is released unter the revised BSD license

Changelog

0.3.0 (2026-08-05)

Update supported Python versions. [jugmac00] & [Daverball]
Use GitHub Actions for CI. [jugmac00]
Switch to PEP-420 namespace package [Daverball]

0.2.0 (2018-02-02)

Adds the ability to override the policy apply function. [href]
Adds missing UNSAFE_EVAL constant. [href]

0.1.0 (2018-02-01)

Initial Release. [href]

Release files for more.content-security 0.3.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for more.content-security 0.3.0
File	Size	Uploaded
more_content_security-0.3.0.tar.gz	10.5 kB	Aug 5, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for more.content-security 0.3.0
File	Interpreter	ABI	Platform	Reset
more_content_security-0.3.0-py3-none-any.whl 10.5 kB Aug 5, 2026	Python 3	none	any	Details

Total release size: 21.0 kB

Release files / more_content_security-0.3.0.tar.gz

Download URL	more_content_security-0.3.0.tar.gz
Size	10.5 kB
Tags	Source
SHA-256 checksum How to use checksums	`79de0704cc08eb6caa41c5bd6e2a00d53907c7ca125c26ba0f9c2f7f92364ebc`
BLAKE2b-256 checksum How to use checksums	`058a093353ff8dbe136e311c646d40ba31e286104c0fc28c8c1e6a50d65a0ba3`
Upload date	Aug 5, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.14.6`

Release files / more_content_security-0.3.0-py3-none-any.whl

Download URL	more_content_security-0.3.0-py3-none-any.whl
Size	10.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`028ac487bf8d0e484cebdae2f961c0118e231afbdce445a0bdd8180487cdba4b`
BLAKE2b-256 checksum How to use checksums	`d26e36df7928d9ed07bf9ea45d41ead3b1d18b96df72c1c35ace8cf074866dfa`
Upload date	Aug 5, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.14.6`