Internal
Public Access
Keith SmithandClaude Sonnet 4.5
ec09baf9a5
Since Nginx Proxy Manager is handling Content Security Policy headers at the reverse proxy level, removed django-csp from Django to avoid duplication and simplify configuration. Changes: - Removed django-csp from requirements.txt - Removed CSPMiddleware from middleware stack - Removed CSP_* settings from selfhosted.py - Added comment noting CSP is configured in NPM CSP is now exclusively managed in NPM's Advanced configuration with: - default-src 'self' - script-src/style-src 'self' 'unsafe-inline' (for Django admin) - img-src 'self' data: https: - frame-ancestors 'none' - And other security directives This keeps configuration in one place (NPM) and eliminates dependency on django-csp package. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>