I’ve been reviewing first time contributor @ashishmurugan’s PR 21705 for ticket-31923
It’s in good shape, they’ve done great work. It adds support for two new security headers
COEP and CORP
In my review I steered both to default to off and I think wider input on this would be welcome from the likes of @adamchainz and @robhudson and anyone else with good experience in this area.
I think COEP defaulting to off is not controversial, CORP might seem safe to default to something more restrictive, but I hesitate due to the common whitenoise setup with a CDN.
Whitenoise docs suggest putting its entry below SecurityMiddleware, so it would add the CORP default to those static assets and if they are then served by a CDN does that mean it would take those headers and your site would not load the assets?
I worry it does, so that’s why I asked for a None default and some wider input. The PR also adds a decorator override for each header. Useful for COEP to set just one view restrictive and useful for CORP to set one view less restrictive if you have set a restrictive value with the setting. You could argue less useful if our default is not restrictive.