1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
.. _decorator-chapter:
====================================
Modifying the Policy with Decorators
====================================
Content Security Policies should be restricted and paranoid by default.
You may, on some views, need to expand or change the policy. django-csp
includes four decorators to help.
``@csp_exempt``
===============
Using the ``@csp_exempt`` decorator disables the CSP header on a given
view.
::
from csp.decorators import csp_exempt
# Will not have a CSP header.
@csp_exempt
def myview(request):
return render(...)
You can manually set this on a per-response basis by setting the
``_csp_exempt`` attribute on the response to ``True``::
# Also will not have a CSP header.
def myview(request):
response = render(...)
response._csp_exempt = True
return response
``@csp_update``
===============
The ``@csp_update`` header allows you to **append** values to the source
lists specified in the settings. If there is no setting, the value
passed to the decorator will be used verbatim.
.. note::
To quote the CSP spec: "There's no inheritance; ... the default list
is not used for that resource type" if it is set. E.g., the following
will not allow images from 'self'::
default-src 'self'; img-src imgsrv.com
The arguments to the decorator the same as the :ref:`settings
<configuration-chapter>` without the ``CSP_`` prefix, e.g. ``IMG_SRC``.
(They are also case-insensitive.) The values are either strings, lists
or tuples.
::
from csp.decorators import csp_update
# Will allow images from imgsrv.com.
@csp_update(IMG_SRC='imgsrv.com')
def myview(request):
return render(...)
``@csp_replace``
================
The ``@csp_replace`` decorator allows you to **replace** a source list
specified in settings. If there is no setting, the value passed to the
decorator will be used verbatim. (See the note under ``@csp_update``.)
If the specified value is None, the corresponding key will not be included.
The arguments and values are the same as ``@csp_update``::
from csp.decorators import csp_replace
# settings.CSP_IMG_SRC = ['imgsrv.com']
# Will allow images from imgsrv2.com, but not imgsrv.com.
@csp_replace(IMG_SRC='imgsrv2.com')
def myview(request):
return render(...)
``@csp``
========
If you need to set the entire policy on a view, ignoring all the
settings, you can use the ``@csp`` decorator. The arguments and values
are as above::
from csp.decorators import csp
@csp(DEFAULT_SRC=["'self'"], IMG_SRC=['imgsrv.com'],
SCRIPT_SRC=['scriptsrv.com', 'googleanalytics.com'])
def myview(request):
return render(...)
|
