django-simple-csp 0.2.dev1

django-simple-csp

A simple Middleware for adding CSP headers and nonces in Django

Usage

Requires Django >=1.10

Add it to the INSTALLED_APPS settings variable:

INSTALLED_APPS = [
    ...
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    ...
    'django-simple-csp'
    ...
]

Add it to MIDDLEWARE (not MIDDLEWARE_CLASSES):

MIDDLEWARE = [
    ...
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    ...
    'django-simple-csp.middleware.csp.CSPMiddleware',
    ...
]

{% load csp %}
{% csp_css_hash %}
    td.style-class {
        background-color: red;
    }
{% end_csp_css_hash %}

{% load csp %}
<script nonce={% csp_js_nonce %}>
    alert("bla")
</script>