Help with Django csp

Using Django Deployment
1

I’m trying to work my way through implementing csp. Could someone explain to me why I get this:

The page’s settings would block an inline style (style-src-elem) from being applied because it violates the following directive: “style-src *”

When I use this directive:
CSP_STYLE_SRC = (‘*’)

?
I thought this would let anything through, but apparently it does not. I don’t know how I can begin to filter things when I can’t even get a wildcard to work. Do I not understand how it works, or am I getting syntax wrong?

Thanks

2

If you’re talking about this package - django-csp — Django-CSP 3.8 documentation, then yes, it’s a syntax thing.

From the docs:

CSP_STYLE_SRC
Set the style-src directive. A tuple or list. None

What you’re setting this to is a string, not a tuple or list.

(See the blue note box in the section Configuring django-csp — Django-CSP 3.8 documentation)

(And, if necessary, see the docs on tuples)

3

That’s very helpful.

Thank you!