Skip to content

Comments

Add section on CSP for Django#1983

Open
Anto59290 wants to merge 4 commits intoOWASP:masterfrom
Anto59290:patch-1
Open

Add section on CSP for Django#1983
Anto59290 wants to merge 4 commits intoOWASP:masterfrom
Anto59290:patch-1

Conversation

@Anto59290
Copy link

@Anto59290 Anto59290 commented Jan 22, 2026

You're A Rockstar

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

  • In case of a new Cheat Sheet, you have used the Cheat Sheet template.
  • All the markdown files do not raise any validation policy violation, see the policy.
  • All the markdown files follow these format rules.
  • All your assets are stored in the assets folder.
  • All the images used are in the PNG format.
  • Any references to websites have been formatted as [TEXT](URL)
  • You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
  • The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR fixes issue #<REPLACE WITH ISSUE NUMBER>.

AI Tool Usage Disclosure (required for all PRs)

Please select one of the following options:

  • I have NOT used any AI tool to generate the contents of this PR.
  • I have used AI tools to generate the contents of this PR. I have verified
    the contents and I affirm the results. The LLM used is [llm name and version]
    and the prompt used is [your prompt here]. [Feel free to add more details if needed]

Thank you again for your contribution 😃


## Content Security Policy

- Include the `django.middleware.csp.ContentSecurityPolicyMiddleware` module in the `MIDDLEWARE` setting in your project's `settings.py` to add CSP related header to your responses.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would recommend adding a link to Django's documentation for CSP middleware. This will help the reader explore further if they are interested.

"style-src": [CSP.SELF],
}
```
- Add the csp context processor to your TEMPLATES setting, this will add the nonce to the context of all your Django templates
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would recommend adding a link to the nonce section of the Content Security Policy Cheatsheet that explains nonces further.

@jmanico
Copy link
Member

jmanico commented Jan 23, 2026

These seems small and reasonable. If you give us a clean PR on just this and only this I will accept it.

Also, please run your sentences through a grammar checker as well, or ask AI to check your sentences for grammar.

jmanico
jmanico previously approved these changes Jan 23, 2026
@bad-antics

This comment was marked as spam.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a new section on Content Security Policy (CSP) implementation to the Django Security Cheat Sheet. The section aims to provide guidance on configuring CSP headers in Django applications.

Changes:

  • Added a new "Content Security Policy" section with middleware configuration, CSP policy settings, template context processor configuration, and nonce usage examples

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants