{"title":"Hur man använder Djangos Content Security Policy","version":"6.0","locale":"sv","docname":"howto/csp","url":"/sv/6.0/howto/csp/","canonical":"https://djangodocs.dev/sv/6.0/howto/csp/","summary":"Grundläggande konfiguration Link to this heading # Så här aktiverar du Content Security Policy (CSP) i ditt Django-projekt: Lägg till CSP-mellanprogramvaran till…","html":"

Hur man använder Djangos Content Security PolicyLink to this heading#

\n
\n

Grundläggande konfigurationLink to this heading#

\n

Så här aktiverar du Content Security Policy (CSP) i ditt Django-projekt:

\n
    \n

  1. Lägg till CSP-mellanprogramvaran till din MIDDLEWARE-inställning:

    \n
    Code
    MIDDLEWARE = [\n    # ...\n    "django.middleware.csp.ContentSecurityPolicyMiddleware",\n    # ...\n]\n
    \n
    2. \n

  2. Konfigurera CSP-policyerna i din settings.py med antingen SECURE_CSP eller SECURE_CSP_REPORT_ONLY (eller båda). CSP-inställningsdokumentationen ger mer information om skillnaderna mellan dessa två:

    \n
    Code
    from django.utils.csp import CSP\n\n# To enforce a CSP policy:\nSECURE_CSP = {\n    "default-src": [CSP.SELF],\n    # Add more directives to be enforced.\n}\n\n# Or for report-only mode:\nSECURE_CSP_REPORT_ONLY = {\n    "default-src": [CSP.SELF],\n    # Add more directives as needed.\n    "report-uri": "/path/to/reports-endpoint/",\n}\n
    \n
    3. \n
\n
\n
\n

Nonce-konfigurationLink to this heading#

\n

För att använda nonces i din CSP-policy måste du, förutom den grundläggande konfigurationen, göra följande:

\n
    \n

  1. Inkludera platshållarvärdet NONCE i CSP-inställningarna. Detta gäller endast direktiven script-src eller style-src:

    \n
    Code
    from django.utils.csp import CSP\n\nSECURE_CSP = {\n    "default-src": [CSP.SELF],\n    # Allow self-hosted scripts and script tags with matching `nonce` attr.\n    "script-src": [CSP.SELF, CSP.NONCE],\n    # Example of the less secure 'unsafe-inline' option.\n    "style-src": [CSP.SELF, CSP.UNSAFE_INLINE],\n}\n
    \n
    2. \n

  2. Lägg till csp()-kontextprocessorn till din TEMPLATES-inställning. Detta gör det genererade nonce-värdet tillgängligt i Django-mallarna som kontextvariabeln csp_nonce:

    \n
    Code
    TEMPLATES = [\n    {\n        "BACKEND": "django.template.backends.django.DjangoTemplates",\n        "OPTIONS": {\n            "context_processors": [\n                # ...\n                "django.template.context_processors.csp",\n            ],\n        },\n    },\n]\n
    \n
    3. \n

  3. I dina mallar lägger du till attributet nonce till relevanta inline-taggarna <style> eller <script> med hjälp av kontextvariabeln csp_nonce:

    \n
    Django template
    <style nonce="{{ csp_nonce }}">\n  /* These inline styles will be allowed. */\n</style>\n\n<script nonce="{{ csp_nonce }}">\n  // This inline JavaScript will be allowed.\n</script>\n
    \n
    4. \n
\n\n
","rootId":"how-to-use-django-s-content-security-policy","toc":[{"title":"Grundläggande konfiguration","anchor":"basic-config","children":[]},{"title":"Nonce-konfiguration","anchor":"nonce-config","children":[]}],"breadcrumbs":[{"docname":"howto/index","title":"Hur man gör-guider","url":"/sv/6.0/howto/"}],"prev":{"docname":"howto/auth-remote-user","title":"Hur man autentiserar med hjälp av REMOTE_USER","url":"/sv/6.0/howto/auth-remote-user/"},"next":{"docname":"howto/csrf","title":"Så här använder du Djangos CSRF-skydd","url":"/sv/6.0/howto/csrf/"},"formats":{"html":"/sv/6.0/howto/csp/","markdown":"/sv/6.0/howto/csp.md","json":"/sv/6.0/howto/csp.json"},"source":"https://github.com/django/django/blob/stable/6.0.x/docs/howto/csp.txt","official":"https://docs.djangoproject.com/sv/6.0/howto/csp/","inVersions":["6.1","6.0"],"inLocales":["en","sv","zh-hans","ga","fr","ja","id","it","pt-br","ko","es","el","pl"]}