mirror of
https://github.com/django/django.git
synced 2025-10-31 09:41:08 +00:00
d63241ebc7
This initial work adds a pair of settings to configure specific CSP directives for enforcing or reporting policy violations, a new `django.middleware.csp.ContentSecurityPolicyMiddleware` to apply the appropriate headers to responses, and a context processor to support CSP nonces in templates for safely inlining assets. Relevant documentation has been added for the 6.0 release notes, security overview, a new how-to page, and a dedicated reference section. Thanks to the multiple reviewers for their precise and valuable feedback. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
48 lines
1.1 KiB
Python
48 lines
1.1 KiB
Python
import json
|
|
import sys
|
|
|
|
from django.http import HttpResponse
|
|
from django.middleware.csp import get_nonce
|
|
from django.utils.decorators import method_decorator
|
|
from django.views.debug import technical_500_response
|
|
from django.views.decorators.common import no_append_slash
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
from django.views.generic import View
|
|
|
|
|
|
def empty_view(request, *args, **kwargs):
|
|
return HttpResponse()
|
|
|
|
|
|
@no_append_slash
|
|
def sensitive_fbv(request, *args, **kwargs):
|
|
return HttpResponse()
|
|
|
|
|
|
@method_decorator(no_append_slash, name="dispatch")
|
|
class SensitiveCBV(View):
|
|
def get(self, *args, **kwargs):
|
|
return HttpResponse()
|
|
|
|
|
|
def csp_nonce(request):
|
|
return HttpResponse(get_nonce(request))
|
|
|
|
|
|
def csp_500(request):
|
|
try:
|
|
raise Exception
|
|
except Exception:
|
|
return technical_500_response(request, *sys.exc_info())
|
|
|
|
|
|
csp_reports = []
|
|
|
|
|
|
@csrf_exempt
|
|
def csp_report_view(request):
|
|
if request.method == "POST":
|
|
data = json.loads(request.body)
|
|
csp_reports.append(data)
|
|
return HttpResponse(status=204)
|