#15727: Add support for Content-Security-Policy (CSP) to core
-------------------------------+------------------------------------
Reporter: db.pub.mail@… | Owner: Rudolph
Type: New feature | Status: assigned
Component: HTTP handling | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 1
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Changes (by erikr):
* needs_docs: 0 => 1
Comment:
Thanks for that patch. In general, I think it is important that we
document well how to change projects to be CSP-compatible. The easier we
make this, the more projects will use CSP, the safer people will be. A few
quick notes:
* I agree with PaulM that we could accept having the admin not CSP-
compatible. However, we should very clearly document that CSP currently
breaks with the admin. If I remember correctly, mozilla's django-csp
allows one to add excluded paths, so that one can have both CSP and the
admin enabled. That does reduce effectiveness, of course, but is better
than no CSP.
* With in-line javascript no longer allowed, it would be useful to point
out `<script type="application/json"></script>` to people, which if my
memory serves me right makes it easy to include a bit of json in your
templates without violating CSP. Not 100% sure here though.
* That can also help for the `{% url %}` problem described in comment:2,
but perhaps there are other suggestions we can make.
* This also deserves a place in the 1.8 release notes and in the security
documentation (we have a specific page for that).
--
Ticket URL: <https://code.djangoproject.com/ticket/15727#comment:14>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/079.d0c0a08024d2def626245b4654b0f238%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
