Implement CSP for archweb

Add django-csp as dependency to be able to set CSP inside django's
settings and allow setting a CSP_NONCE for inline <script>'s in
templates. Since archweb heavily uses this pattern it's the best
compromise.

1 files changed, 8 insertions, 0 deletions

diff --git a/settings.py b/settings.py
index 10114f11..17377c25 100644
--- a/settings.py
+++ b/settings.py
@@ -53,6 +53,7 @@ MIDDLEWARE = (
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'django.middleware.security.SecurityMiddleware',
     'django.middleware.http.ConditionalGetMiddleware',
+    'csp.middleware.CSPMiddleware',
 )
 
 # Base of the URL hierarchy
@@ -92,6 +93,12 @@ SECURE_CONTENT_TYPE_NOSNIFF = True
 # X-XSS-Protection, enables cross-site scripting filter in most browsers
 SECURE_BROWSER_XSS_FILTER = True
 
+# CSP Settings
+CSP_DEFAULT_SRC = ("'self'",)
+CSP_SCRIPT_SRC = ("'self'",)
+CSP_INCLUDE_NONCE_IN = ['script-src']
+CSP_IMG_SRC = ("'self'", 'data:',)
+
 # Use new test runner
 TEST_RUNNER = 'django.test.runner.DiscoverRunner'
 
@@ -194,6 +201,7 @@ TEMPLATES = [
                 'django.contrib.auth.context_processors.auth',
                 'django.template.context_processors.debug',
                 'django.contrib.messages.context_processors.messages',
+                'csp.context_processors.nonce',
             ],
         }
     }