Nonce-only CSP directives are omitted when the nonce is unused

[venkatchalla06]

Django 6.0 added built-in CSP. In django.utils.csp.build_policy(), when a directive's only source is CSP.NONCE and the per-request nonce was never accessed (the LazyNonce stays falsy because the response rendered no {{ csp_nonce }}), the sentinel is stripped, the directive becomes empty, and the directive is dropped from the header entirely. For the same configuration, the emitted policy then depends on whether the nonce happened to be used:

• {"default-src": ["*"], "script-src": [CSP.NONCE]} — nonce used: default-src *; script-src 'nonce-...'; nonce unused: default-src * (script-src removed, scripts fall back to *).
• {"script-src": [CSP.NONCE]} — nonce unused: an empty Content-Security-Policy header (no policy at all).
• {"script-src": [CSP.SELF, CSP.NONCE]} (recommended) — nonce unused: script-src 'self' (fails closed, unaffected).

So a nonce-only directive silently degrades to its default-src fallback (possibly permissive) or to no policy, on exactly the responses most likely to carry injected markup (error pages, views with no inline nonce'd element). The recommended form — pairing CSP.NONCE with an explicit fallback — already fails closed.

Proposed: a new system check, security.W028, that warns when any SECURE_CSP or SECURE_CSP_REPORT_ONLY directive's only source is CSP.NONCE, hinting to add CSP.SELF, CSP.STRICT_DYNAMIC, or CSP.NONE. It mirrors the existing security.W027 and makes no runtime behavior change. A patch with tests and docs is ready.

An alternative would be to make build_policy() fail closed (keep the directive present as block-all when the nonce is unused), but that changes documented output and would need a release note; a check seems the lower-risk fix.

[Jacob Walls]

I'm not certain that recommending a fallback is a good idea in all cases. Rob, do you have thoughts?

[NAYAN SHARMA]

Hi, I'd like to contribute to this ticket. I noticed the description mentions that a patch with tests and documentation is ready, although the ticket currently shows “Has patch: no.”

Is someone already preparing or reviewing that patch? If help is still needed, I'd be happy to test the proposed behaviour and look for missing edge cases before working on a separate implementation.

[Jacob Walls]

It's not accepted yet, which means we don't even know if we want this yet.

[NAYAN SHARMA]

Hi Jacob, would you mind taking a look at my PR for ticket #37414 when you have some time? I’d appreciate any feedback or suggestions for improvement. Thank you! Replying to Jacob Walls:

It's not accepted yet, which means we don't even know if we want this yet.

[Sanskar Kharya]

Pull request: ​https://github.com/django/django/pull/22179
This adds a new system check, security.W028, that warns when a CSP directive's only source is CSP.NONCE, since that directive is dropped from the header when the nonce is never used. Tests and docs included.

[Sarah Boyce]

#37441 was a duplicate

Thank you for the report! I agree we should do something here
The best approach needs further consideration, so I’ve updated the title to describe the issue without prescribing a system check.

See also #37419, where we decided to generate configured CSP nonces eagerly for streaming responses so they are included in the headers.
We should consider whether to do the same when CSP.NONCE is a directive’s only source.

[Rob Hudson]

This is an interesting edge case. I would recommend emitting csp.NONE when removing the nonce sentinel leaves a directive empty. If no element carries the nonce, the set of scripts matching the nonce is empty, which is exactly what 'none' means and it's a much better fallback than empty where the policy fails open.

[Sanskar Kharya]

Thanks Rob and Jacob. I've updated the PR to emit 'none' when removing the nonce sentinel leaves a directive empty, instead of eagerly generating the nonce. Directives that are explicitly configured empty are still omitted, and directives with other sources are unchanged. Tests and docs updated.

[Jacob Walls <jacobtylerwalls@…>]

In 549605de:

Fixed #37395 -- Emitted 'none' for CSP directives left empty by an unused nonce.

Before, if a directive's only source was a nonce, and that nonce was not rendered,
the directive was omitted, when in reality we should consider the set of scripts
matching the nonce to be empty, and instead fail closed.

Thanks Rob Hudson for the implementation idea and review.