Keith SmithandClaude Sonnet 4.5 e95369ffbf Add Content Security Policy (CSP) headers ...

Implements CSP to prevent XSS attacks and complete Mozilla Observatory
security requirements.

Changes:
- Added django-csp>=3.8 to requirements.txt
- Added CSPMiddleware to middleware stack
- Configured CSP directives in selfhosted.py:
  - default-src 'self' (only load resources from same origin)
  - script-src/style-src allow 'unsafe-inline' (needed for Django admin)
  - img-src allows https: and data: URIs
  - frame-ancestors 'none' (prevent clickjacking)
  - form-action 'self' (prevent form hijacking)

This policy balances security with Django admin functionality.
After deployment, Mozilla Observatory should show all green checks.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 17:40:34 -07:00

..

settings

Add Content Security Policy (CSP) headers

2025-12-26 17:40:34 -07:00

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

asgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

celery.py

Fix Critical Security Issue: Replace print() with proper logging

2025-12-22 22:34:57 -07:00

urls.py

Add API root endpoint at /api/

2025-12-26 17:24:16 -07:00

views.py

Add API root endpoint at /api/

2025-12-26 17:24:16 -07:00

wsgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00