DarkSingularity/KeepItGoingServer
Internal
Public Access
2
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases 1 Wiki Activity

Add Content Security Policy (CSP) headers

Browse Source 
Implements CSP to prevent XSS attacks and complete Mozilla Observatory
security requirements.

Changes:
- Added django-csp>=3.8 to requirements.txt
- Added CSPMiddleware to middleware stack
- Configured CSP directives in selfhosted.py:
  - default-src 'self' (only load resources from same origin)
  - script-src/style-src allow 'unsafe-inline' (needed for Django admin)
  - img-src allows https: and data: URIs
  - frame-ancestors 'none' (prevent clickjacking)
  - form-action 'self' (prevent form hijacking)

This policy balances security with Django admin functionality.
After deployment, Mozilla Observatory should show all green checks.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Keith Smith
2025-12-26 17:40:34 -07:00
co-authored by Claude Sonnet 4.5
parent 00fca071bf
commit e95369ffbf
3 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements.txt
+3
View File
@@ -28,3 +28,6 @@ Pillow>=10.0.0
# Production
gunicorn>=21.0.0
whitenoise>=6.6.0
# Security
django-csp>=3.8