Internal
Public Access
Keith SmithandClaude Sonnet 4.5
e95369ffbf
Implements CSP to prevent XSS attacks and complete Mozilla Observatory security requirements. Changes: - Added django-csp>=3.8 to requirements.txt - Added CSPMiddleware to middleware stack - Configured CSP directives in selfhosted.py: - default-src 'self' (only load resources from same origin) - script-src/style-src allow 'unsafe-inline' (needed for Django admin) - img-src allows https: and data: URIs - frame-ancestors 'none' (prevent clickjacking) - form-action 'self' (prevent form hijacking) This policy balances security with Django admin functionality. After deployment, Mozilla Observatory should show all green checks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
34 lines
560 B
Plaintext
34 lines
560 B
Plaintext
# Django core
|
|
Django>=5.0,<6.0
|
|
django-environ>=0.11.0
|
|
django-cors-headers>=4.3.0
|
|
django-filter>=24.0
|
|
|
|
# Django REST Framework
|
|
djangorestframework>=3.14.0
|
|
djangorestframework-simplejwt>=5.3.0
|
|
|
|
# Database
|
|
psycopg2-binary>=2.9.9 # PostgreSQL driver
|
|
dj-database-url>=2.1.0 # Universal database URL parser
|
|
|
|
# Task queue
|
|
celery>=5.3.0
|
|
redis>=5.0.0
|
|
django-celery-beat>=2.5.0
|
|
|
|
# Push notifications
|
|
firebase-admin>=6.4.0
|
|
pywebpush>=1.14.0
|
|
|
|
# Utilities
|
|
python-dateutil>=2.8.2
|
|
Pillow>=10.0.0
|
|
|
|
# Production
|
|
gunicorn>=21.0.0
|
|
whitenoise>=6.6.0
|
|
|
|
# Security
|
|
django-csp>=3.8
|