From d63241ebc7067fdebbaf704989b34fcd8f26bbe9 Mon Sep 17 00:00:00 2001 From: Rob Hudson Date: Sat, 3 May 2025 10:01:58 -0700 Subject: Fixed #15727 -- Added Content Security Policy (CSP) support. This initial work adds a pair of settings to configure specific CSP directives for enforcing or reporting policy violations, a new `django.middleware.csp.ContentSecurityPolicyMiddleware` to apply the appropriate headers to responses, and a context processor to support CSP nonces in templates for safely inlining assets. Relevant documentation has been added for the 6.0 release notes, security overview, a new how-to page, and a dedicated reference section. Thanks to the multiple reviewers for their precise and valuable feedback. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> --- docs/ref/templates/api.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'docs/ref/templates') diff --git a/docs/ref/templates/api.txt b/docs/ref/templates/api.txt index 8d5c66367d..f1fb70c9b8 100644 --- a/docs/ref/templates/api.txt +++ b/docs/ref/templates/api.txt @@ -802,6 +802,18 @@ This processor adds a token that is needed by the :ttag:`csrf_token` template tag for protection against :doc:`Cross Site Request Forgeries `. +``django.template.context_processors.csp`` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +.. function:: csp(request) + +.. versionadded:: 6.0 + +If this processor is enabled, every ``RequestContext`` will contain a variable +``csp_nonce``, providing a securely generated, request-specific nonce suitable +for use under a Content Security Policy. See :ref:`CSP nonce usage ` +for details. + ``django.template.context_processors.request`` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- cgit v1.3