djangodocs

Django 6.1
日本語
Documentation contents

How to use Django's Content Security Policy

Basic config

To enable Content Security Policy (CSP) in your Django project:

  1. Add the CSP middleware to your MIDDLEWARE setting:

    Code
    MIDDLEWARE = [
    # ...
    "django.middleware.csp.ContentSecurityPolicyMiddleware",
    # ...
]

  2. Configure the CSP policies in your settings.py using either SECURE_CSP or SECURE_CSP_REPORT_ONLY (or both). The CSP Settings docs provide more details about the differences between these two:

    Code
    from django.utils.csp import CSP

# To enforce a CSP policy:
SECURE_CSP = {
    "default-src": [CSP.SELF],
    # Add more directives to be enforced.
}

# Or for report-only mode:
SECURE_CSP_REPORT_ONLY = {
    "default-src": [CSP.SELF],
    # Add more directives as needed.
    "report-uri": "/path/to/reports-endpoint/",
}

Nonce config

To use nonces in your CSP policy, beside the basic config, you need to:

  1. Include the NONCE placeholder value in the CSP settings. This only applies to script-src or style-src directives:

    Code
    from django.utils.csp import CSP

SECURE_CSP = {
    "default-src": [CSP.SELF],
    # Allow self-hosted scripts and script tags with matching `nonce` attr.
    "script-src": [CSP.SELF, CSP.NONCE],
    # Example of the less secure 'unsafe-inline' option.
    "style-src": [CSP.SELF, CSP.UNSAFE_INLINE],
}

  2. Add the csp() context processor to your TEMPLATES setting. This makes the generated nonce value available in the Django templates as the csp_nonce context variable:

    Code
    TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "OPTIONS": {
            "context_processors": [
                # ...
                "django.template.context_processors.csp",
            ],
        },
    },
]

  3. In your templates, add the nonce to elements that require it:

    For inline <style> or <script> tags, use the csp_nonce context variable directly:

    Django template
    <style nonce="{{ csp_nonce }}">
  /* These inline styles will be allowed. */
</style>

<script nonce="{{ csp_nonce }}">
  // This inline JavaScript will be allowed.
</script>

    For external <script src="..."> and <link rel="stylesheet"> elements, use the csp_nonce_attr template tag:

    Django template
    <script src="/path/to/script.js" {% csp_nonce_attr %}></script>
<link rel="stylesheet" href="/path/to/style.css" {% csp_nonce_attr %}>

    To render a Media object's assets with the nonce applied to each element, pass the object to the csp_nonce_attr tag:

    Django template
    {% csp_nonce_attr form.media %}

This page as Markdown JSON

Edit this page on GitHub Official version