Keith SmithandClaude Sonnet 4.5 e95369ffbf Add Content Security Policy (CSP) headers ...

Implements CSP to prevent XSS attacks and complete Mozilla Observatory
security requirements.

Changes:
- Added django-csp>=3.8 to requirements.txt
- Added CSPMiddleware to middleware stack
- Configured CSP directives in selfhosted.py:
  - default-src 'self' (only load resources from same origin)
  - script-src/style-src allow 'unsafe-inline' (needed for Django admin)
  - img-src allows https: and data: URIs
  - frame-ancestors 'none' (prevent clickjacking)
  - form-action 'self' (prevent form hijacking)

This policy balances security with Django admin functionality.
After deployment, Mozilla Observatory should show all green checks.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 17:40:34 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Add Content Security Policy (CSP) headers

2025-12-26 17:40:34 -07:00

development.py

Add tasks.firebugit.com to development server configuration

2025-12-23 06:08:39 -07:00

production.py

Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

2025-12-23 06:23:34 -07:00

selfhosted.py

Add Content Security Policy (CSP) headers

2025-12-26 17:40:34 -07:00