Django 3 Web Development Cookbook - Fourth Edition

Making requests secure with Content Security Policy (CSP)

Dynamic multi-user websites usually allow users to add all kinds of data from a wide variety of media types: images, videos, audios, HTML, JavaScript snippets, and so on. This opens up the potential of users adding malicious code to the website that could steal cookies or other personal information, call unwanted Ajax requests in the background, or do other harm. Modern browsers support an extra layer of security that whitelists the sources of your media resources. It is called CSP and in this recipe, we will show you how to use it within a Django website.