Configuring django-csp
Content-Security-Policy is a complicated header. There are many values you may need to tweak here.
It’s worth reading the latest CSP spec and making sure you understand it before configuring django-csp.
Note
Many settings require a tuple
or list
. You may get very strange
policies and even errors when mistakenly configuring them as a string
.
Policy Settings
These settings affect the policy in the header. The defaults are in italics.
Note
Deprecated features of CSP in general have been moved to the bottom of this list.
Warning
The “special” source values of 'self'
, 'unsafe-inline'
,
'unsafe-eval'
, 'none'
and hash-source ('sha256-...'
) must be
quoted! e.g.: CSP_DEFAULT_SRC = ("'self'",)
. Without quotes they will
not work as intended.
CSP_DEFAULT_SRC
Set the
default-src
directive. Atuple
orlist
of values, e.g.:("'self'", 'cdn.example.net')
. [“‘self’”]CSP_SCRIPT_SRC
Set the
script-src
directive. Atuple
orlist
. NoneCSP_SCRIPT_SRC_ATTR
Set the
script-src-attr
directive. Atuple
orlist
. NoneCSP_SCRIPT_SRC_ELEM
Set the
script-src-elem
directive. Atuple
orlist
. NoneCSP_IMG_SRC
Set the
img-src
directive. Atuple
orlist
. NoneCSP_OBJECT_SRC
Set the
object-src
directive. Atuple
orlist
. NoneCSP_MEDIA_SRC
Set the
media-src
directive. Atuple
orlist
. NoneCSP_FRAME_SRC
Set the
frame-src
directive. Atuple
orlist
. NoneCSP_FONT_SRC
Set the
font-src
directive. Atuple
orlist
. NoneCSP_CONNECT_SRC
Set the
connect-src
directive. Atuple
orlist
. NoneCSP_STYLE_SRC
Set the
style-src
directive. Atuple
orlist
. NoneCSP_STYLE_SRC_ATTR
Set the
style-src-attr
directive. Atuple
orlist
. NoneCSP_STYLE_SRC_ELEM
Set the
style-src-elem
directive. Atuple
orlist
. NoneCSP_BASE_URI
Set the
base-uri
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_CHILD_SRC
Set the
child-src
directive. Atuple
orlist
. NoneCSP_FRAME_ANCESTORS
Set the
frame-ancestors
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_NAVIGATE_TO
Set the
navigate-to
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_FORM_ACTION
Set the
FORM_ACTION
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_SANDBOX
Set the
sandbox
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_REPORT_URI
Set the
report-uri
directive. Atuple
orlist
of URIs. Each URI can be a full or relative URI. NoneNote: This doesn’t use
default-src
as a fall-back.CSP_REPORT_TO
Set the
report-to
directive. Astring
describing a reporting group. NoneSee Section 1.2: https://w3c.github.io/reporting/#group
Also see this MDN note on
report-uri
andreport-to
.CSP_MANIFEST_SRC
Set the
manifest-src
directive. Atuple
orlist
. NoneCSP_WORKER_SRC
Set the
worker-src
directive. Atuple
orlist
. NoneCSP_REQUIRE_SRI_FOR
Set the
require-sri-for
directive. Atuple
orlist
. NoneValid values: a
list
containing'script'
,'style'
, or both.CSP_UPGRADE_INSECURE_REQUESTS
Include
upgrade-insecure-requests
directive. Aboolean
. FalseCSP_REQUIRE_TRUSTED_TYPES_FOR
Include
require-trusted-types-for
directive. Atuple
orlist
. NoneValid values:
["'script'"]
CSP_TRUSTED_TYPES
Include
trusted-types
directive. Atuple
orlist
. NoneValid values: a
list
of allowed policy names that may includedefault
and/or'allow-duplicates'
CSP_INCLUDE_NONCE_IN
Include dynamically generated nonce in all listed directives. A
tuple
orlist
, e.g.:CSP_INCLUDE_NONCE_IN = ['script-src']
will add'nonce-<b64-value>'
to thescript-src
directive. [‘default-src’]Note: The nonce value will only be generated if
request.csp_nonce
is accessed during the request/response cycle.
Deprecated CSP settings
The following settings are still configurable, but are considered deprecated in terms of the latest implementation of the relevant spec.
CSP_BLOCK_ALL_MIXED_CONTENT
Include
block-all-mixed-content
directive. Aboolean
. FalseRelated note on MDN.
Spec: block-all-mixed-content
CSP_PLUGIN_TYPES
Set the
plugin-types
directive. Atuple
orlist
. NoneNote: This doesn’t use
default-src
as a fall-back.Related note on MDN.
CSP_PREFETCH_SRC
Set the
prefetch-src
directive. Atuple
orlist
. NoneRelated note on MDN.
Changing the Policy
The policy can be changed on a per-view (or even per-request) basis. See the decorator documentation for more details.
Other Settings
These settings control the behavior of django-csp. Defaults are in italics.
CSP_REPORT_ONLY
Send “report-only” headers instead of real headers. A
boolean
. FalseCSP_EXCLUDE_URL_PREFIXES
A
tuple
(not alist
) of URL prefixes. URLs beginning with any of these will not get the CSP headers. ()
Warning
Excluding any path on your site will eliminate the benefits of CSP
everywhere on your site. The typical browser security model for
JavaScript considers all paths alike. A Cross-Site Scripting flaw
on, e.g., excluded-page/
can therefore be leveraged to access
everything on the same origin.