CSP nonces in the admin site?

Using Django
1

Hello,

when I activate a Content Security Policy with the following directives:

SECURE_CSP = {
    "object-src": [CSP.NONE],
    "base-uri": [CSP.NONE],
    "script-src": [CSP.NONCE, CSP.STRICT_DYNAMIC],
}

the Django admin site breaks, because no nonces are added to the scripts used there.

What is a good way to approach this?

2

Yep, breaks for me too. Although I also am finding weird recursion errors too, so I think using CSP.NONCE is not recommended for now.

3

Hello, would you be interested in opening a ticket to report the issue?

4

I’ve opened a ticket in the Django issue tracker:

1 Like