Opened 4 months ago

Closed 3 months ago

#36532 closed New feature (fixed)

Add Content Security Policy (CSP) view decorators

Reported by: Rob Hudson Owned by: Rob Hudson
Component: HTTP handling Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

View decorators allow users to customize their CSP headers per-view. Allowing to override the base CSP settings and disable the headers should support most use cases.

Change History (6)

comment:1 by Rob Hudson, 4 months ago

Has patch: set

Pull request: ​https://github.com/django/django/pull/19680

comment:2 by Natalia Bidart, 4 months ago

Triage Stage: Unreviewed → Accepted

Thank you! This is consistent with what we discussed in the CSP original work, to allow splitting the feature in manageable chunks.

comment:3 by Natalia Bidart, 4 months ago

Patch needs improvement: set

comment:4 by Rob Hudson, 3 months ago

Patch needs improvement: unset

Updated to separate the decorators as requested in the PR review.

comment:5 by Natalia Bidart, 3 months ago

Triage Stage: Accepted → Ready for checkin

comment:6 by nessita <124304+nessita@…>, 3 months ago

Resolution: → fixed
Status: assigned → closed

In 550822bc:

Fixed #36532 -- Added Content Security Policy view decorators to override or disable policies.

Co-authored-by: Natalia <124304+nessita@…>

Note: See TracTickets for help on using tickets.
Back to Top