Configuring django-csp

Content-Security-Policy is a complicated header. There are many values you may need to tweak here.

It’s worth reading the latest CSP spec and making sure you understand it before configuring django-csp.

Note

Many settings require a tuple or list. You may get very strange policies and even errors when mistakenly configuring them as a string.

Policy Settings

These settings affect the policy in the header. The defaults are in italics.

Note

Deprecated features of CSP in general have been moved to the bottom of this list.

Warning

The “special” source values of 'self', 'unsafe-inline', 'unsafe-eval', 'none' and hash-source ('sha256-...') must be quoted! e.g.: CSP_DEFAULT_SRC = ("'self'",). Without quotes they will not work as intended.

CSP_DEFAULT_SRC

Set the default-src directive. A tuple or list of values, e.g.: ("'self'", 'cdn.example.net'). [“‘self’”]

CSP_SCRIPT_SRC

Set the script-src directive. A tuple or list. None

CSP_SCRIPT_SRC_ATTR

Set the script-src-attr directive. A tuple or list. None

CSP_SCRIPT_SRC_ELEM

Set the script-src-elem directive. A tuple or list. None

CSP_IMG_SRC

Set the img-src directive. A tuple or list. None

CSP_OBJECT_SRC

Set the object-src directive. A tuple or list. None

CSP_MEDIA_SRC

Set the media-src directive. A tuple or list. None

CSP_FRAME_SRC

Set the frame-src directive. A tuple or list. None

CSP_FONT_SRC

Set the font-src directive. A tuple or list. None

CSP_CONNECT_SRC

Set the connect-src directive. A tuple or list. None

CSP_STYLE_SRC

Set the style-src directive. A tuple or list. None

CSP_STYLE_SRC_ATTR

Set the style-src-attr directive. A tuple or list. None

CSP_STYLE_SRC_ELEM

Set the style-src-elem directive. A tuple or list. None

CSP_BASE_URI

Set the base-uri directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

CSP_CHILD_SRC

Set the child-src directive. A tuple or list. None

CSP_FRAME_ANCESTORS

Set the frame-ancestors directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

CSP_NAVIGATE_TO

Set the navigate-to directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

CSP_FORM_ACTION

Set the FORM_ACTION directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

CSP_SANDBOX

Set the sandbox directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

CSP_REPORT_URI

Set the report-uri directive. A tuple or list of URIs. Each URI can be a full or relative URI. None

Note: This doesn’t use default-src as a fall-back.

CSP_REPORT_TO

Set the report-to directive. A string describing a reporting group. None

See Section 1.2: https://w3c.github.io/reporting/#group

Also see this MDN note on report-uri and report-to.

CSP_MANIFEST_SRC

Set the manifest-src directive. A tuple or list. None

CSP_WORKER_SRC

Set the worker-src directive. A tuple or list. None

CSP_REQUIRE_SRI_FOR

Set the require-sri-for directive. A tuple or list. None

Valid values: a list containing 'script', 'style', or both.

Spec: require-sri-for-known-tokens

CSP_UPGRADE_INSECURE_REQUESTS

Include upgrade-insecure-requests directive. A boolean. False

Spec: upgrade-insecure-requests

CSP_REQUIRE_TRUSTED_TYPES_FOR

Include require-trusted-types-for directive. A tuple or list. None

Valid values: ["'script'"]

CSP_TRUSTED_TYPES

Include trusted-types directive. A tuple or list. None

Valid values: a list of allowed policy names that may include default and/or 'allow-duplicates'

CSP_INCLUDE_NONCE_IN

Include dynamically generated nonce in all listed directives. A tuple or list, e.g.: CSP_INCLUDE_NONCE_IN = ['script-src'] will add 'nonce-<b64-value>' to the script-src directive. [‘default-src’]

Note: The nonce value will only be generated if request.csp_nonce is accessed during the request/response cycle.

Deprecated CSP settings

The following settings are still configurable, but are considered deprecated in terms of the latest implementation of the relevant spec.

CSP_BLOCK_ALL_MIXED_CONTENT

Include block-all-mixed-content directive. A boolean. False

Related note on MDN.

Spec: block-all-mixed-content

CSP_PLUGIN_TYPES

Set the plugin-types directive. A tuple or list. None

Note: This doesn’t use default-src as a fall-back.

Related note on MDN.

CSP_PREFETCH_SRC

Set the prefetch-src directive. A tuple or list. None

Related note on MDN.

Changing the Policy

The policy can be changed on a per-view (or even per-request) basis. See the decorator documentation for more details.

Other Settings

These settings control the behavior of django-csp. Defaults are in italics.

CSP_REPORT_ONLY

Send “report-only” headers instead of real headers. A boolean. False

See the spec and the chapter on reports for more info.

CSP_EXCLUDE_URL_PREFIXES

A tuple (not a list) of URL prefixes. URLs beginning with any of these will not get the CSP headers. ()

Warning

Excluding any path on your site will eliminate the benefits of CSP everywhere on your site. The typical browser security model for JavaScript considers all paths alike. A Cross-Site Scripting flaw on, e.g., excluded-page/ can therefore be leveraged to access everything on the same origin.