Django 3 Web Development Cookbook - Fourth Edition

How it works...

CSP directives can be added to the meta tags in the head section or the response headers:

• The meta tag syntax looks like this:

<meta http-equiv="Content-Security-Policy" content="img-src * data:; default-src 'self' https://stackpath.bootstrapcdn.com/ 'nonce-WWNu7EYqfTcVVZDs'; frame-src *; script-src 'self' https://stackpath.bootstrapcdn.com/ https://code.jquery.com/ https://cdnjs.cloudflare.com/">

• Our chosen django-csp module uses response headers to create the list sources that you want to be loaded into the website. You can check the headers in the Network section of the browser's inspector, as follows:

Content-Security-Policy: img-src * data:; default-src 'self' https://stackpath.bootstrapcdn.com/ 'nonce-WWNu7EYqfTcVVZDs'; ...