#15727: Add support for Content-Security-Policy (CSP) to core
-------------------------------+------------------------------------
Reporter: db.pub.mail@… | Owner: Rudolph
Type: New feature | Status: assigned
Component: HTTP handling | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 1
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Comment (by Rudolph):
Thanks for your comment.
Current pull request does not enable a Content-Security-Policy by default,
because we can make no assumptions about the implementation details of
other people's code. So the admin will stay fully functional unless you
specify a policy which is too strict for the admin. However I agree that
it would be nice to also provide a default policy for the admin (as strict
as currently possible), which should be configurable for people that want
to allow more (i.e. load external scripts).
Comment:2 can be easily solved by putting url's and other data needed by
Javascript in data attributes instead.
I'll add something to the release notes in my update to the pull request.
--
Ticket URL: <https://code.djangoproject.com/ticket/15727#comment:15>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/079.fc1c1e243a8ddd801d3895941f7f676c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
