more.content_security
Content Security Policy for Morepath
Usage
To protect all views with a default content security policy:
from morepath import App
from more.content_security import ContentSecurityApp
from more.content_security import ContentSecurityPolicy
from more.content_security import SELF
class MyApp(App, ContentSecurityApp):
pass
@MyApp.setting('content_security_policy', 'default')
def default_policy():
return ContentSecurityPolicy(
default_src={SELF},
script_src={SELF, 'https://analytics.example.org'}
)To extend the default policy for the default view of a model:
@MyApp.view(model=Document)
def view_document(self, request):
# the actual default policy is not modified here!
request.content_security_policy.script_src.add('https://cdnjs.com')
....We can also use a completely different policy:
@MyApp.view(model=Document)
def view_document(self, request):
request.content_security_policy = ContentSecurityPolicy()Additionally, we can use nonces in inline scripty/stylesheets. Those will automatically be added to the ‘script-src’, ‘style-src’ directives:
@MyApp.html(model=Document)
def view_document(self, request):
return """
<html>
...
<script nonce="{}">...</script>
</html>
""".format(request.content_security_policy_nonce('script'))Note that we use a custom request class for nonces. If you have your own, you need to extend it as follows:
from morepath.request import Request
from more.content_security import ContentSecurityRequest
class CustomRequest(Request, ContentSecurityRequest):
pass
class MyApp(App, ContentSecurityApp):
request_class = CustomRequestTo only use the ‘Content-Security-Policy-Report-Only’ header, use this:
@MyApp.setting('content_security_policy', 'default')
def default_policy():
return ContentSecurityPolicy(
report_only=True,
default_src={SELF}
)Run the Tests
Install tox and run it:
pip install tox tox
Limit the tests to a specific python version:
tox -e py27
Conventions
more.content_security follows PEP8 as close as possible. To test for it run:
tox -e pep8
more.content_security uses Semantic Versioning
License
more.content_security is released unter the revised BSD license
Changelog
0.3.0 (2026-08-05)
Update supported Python versions. [jugmac00] & [Daverball]
Use GitHub Actions for CI. [jugmac00]
Switch to PEP-420 namespace package [Daverball]
0.2.0 (2018-02-02)
Adds the ability to override the policy apply function. [href]
Adds missing UNSAFE_EVAL constant. [href]
0.1.0 (2018-02-01)
Initial Release. [href]
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file more_content_security-0.3.0.tar.gz.
File metadata
- Download URL: more_content_security-0.3.0.tar.gz
- Upload date:
- Size: 10.5 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
79de0704cc08eb6caa41c5bd6e2a00d53907c7ca125c26ba0f9c2f7f92364ebc
|
|
| MD5 |
e4daa448ce797e764f4c33ea8bb97a3a
|
|
| BLAKE2b-256 |
058a093353ff8dbe136e311c646d40ba31e286104c0fc28c8c1e6a50d65a0ba3
|
File details
Details for the file more_content_security-0.3.0-py3-none-any.whl.
File metadata
- Download URL: more_content_security-0.3.0-py3-none-any.whl
- Upload date:
- Size: 10.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
028ac487bf8d0e484cebdae2f961c0118e231afbdce445a0bdd8180487cdba4b
|
|
| MD5 |
632bb6c75eba8dbceb367ad1531054aa
|
|
| BLAKE2b-256 |
d26e36df7928d9ed07bf9ea45d41ead3b1d18b96df72c1c35ace8cf074866dfa
|
