... _ONLY = { "default-src" : [ CSP . SELF ], # Add more directives as needed. "report-uri" : "/path/to/reports-endpoint/" , } Nonce config ¶ To use nonces in your CSP policy, beside the basic config, you need to: Include the NONCE placeholder value in th ... s.csp import CSP SECURE_CSP = { "default-src" : [ CSP . SELF ], # Allow self-hosted scripts and script tags with matching `nonce` attr. "script-src" : [ CSP . SELF , CSP . NONCE ], # Example of the less secure 'unsafe-inline' option. "style-src" : [ C ... SP . SELF , CSP . UNSAFE_INLINE ], } Add the csp() context processor to your TEMPLATES setting. This makes the generated nonce value available in the Django templates as the csp_nonce context variable: TEMPLATES = [ { "BACKEND" : "django.template.ba ... ... ICT_DYNAMIC ¶ Represents 'strict-dynamic' . Allows execution of scripts loaded by a trusted script (e.g., one with a valid nonce or hash), without needing 'unsafe-inline' . UNSAFE_EVAL ¶ Represents 'unsafe-eval' . Allows use of eval() and similar Java ... nts 'wasm-unsafe-eval' . Permits compilation and execution of WebAssembly code without enabling 'unsafe-eval' for scripts. NONCE ¶ Django-specific placeholder value ( "<CSP_NONCE_SENTINEL>" ) used in script-src or style-src directives to activate nonc ... e-based CSP. This string is replaced at runtime by the ContentSecurityPolicyMiddleware with a secure, random nonce that is generated for each request. See detailed explanation in Nonce usage . デコレータ ¶ Django provides decorators to c ... ... _ONLY = { "default-src" : [ CSP . SELF ], # Add more directives as needed. "report-uri" : "/path/to/reports-endpoint/" , } Nonce config ¶ To use nonces in your CSP policy, beside the basic config, you need to: Include the NONCE placeholder value in th ... s.csp import CSP SECURE_CSP = { "default-src" : [ CSP . SELF ], # Allow self-hosted scripts and script tags with matching `nonce` attr. "script-src" : [ CSP . SELF , CSP . NONCE ], # Example of the less secure 'unsafe-inline' option. "style-src" : [ C ... SP . SELF , CSP . UNSAFE_INLINE ], } Add the csp() context processor to your TEMPLATES setting. This makes the generated nonce value available in the Django templates as the csp_nonce context variable: TEMPLATES = [ { "BACKEND" : "django.template.ba ... ... ICT_DYNAMIC ¶ Represents 'strict-dynamic' . Allows execution of scripts loaded by a trusted script (e.g., one with a valid nonce or hash), without needing 'unsafe-inline' . UNSAFE_EVAL ¶ Represents 'unsafe-eval' . Allows use of eval() and similar Java ... nts 'wasm-unsafe-eval' . Permits compilation and execution of WebAssembly code without enabling 'unsafe-eval' for scripts. NONCE ¶ Django-specific placeholder value ( "<CSP_NONCE_SENTINEL>" ) used in script-src or style-src directives to activate nonc ... e-based CSP. This string is replaced at runtime by the ContentSecurityPolicyMiddleware with a secure, random nonce that is generated for each request. See detailed explanation in Nonce usage . デコレータ ¶ Django provides decorators to c ... ... Hash index type. django.contrib.sessions ¶ SessionBase now supports boolean evaluation via __bool__() . CSP ¶ The new csp_nonce_attr template tag renders the CSP nonce attribute on <script> and <link> elements, or renders a Media object's assets with ... the nonce applied, when the csp() context processor is configured. See Nonce usage for details. A new security.W027 system check war ... ns when ContentSecurityPolicyMiddleware is enabled with CSP.NONCE in a CSP policy but django.template.context_processors.csp is not configured. CSP nonce attributes are now added on <scrip ... ... Hash index type. django.contrib.sessions ¶ SessionBase now supports boolean evaluation via __bool__() . CSP ¶ The new csp_nonce_attr template tag renders the CSP nonce attribute on <script> and <link> elements, or renders a Media object's assets with ... the nonce applied, when the csp() context processor is configured. See Nonce usage for details. A new security.W027 system check war ... ns when ContentSecurityPolicyMiddleware is enabled with CSP.NONCE in a CSP policy but django.template.context_processors.csp is not configured. CSP nonce attributes are now added on <scrip ... ... ken ¶ このタグは CSRF の防止のために使用します。詳細は クロスサイトリクエストフォージェリ (CSRF) を参照してください。. csp_nonce_attr ¶ New in Django 6.1. When called without arguments, renders a nonce="<value>" HTML attribute when the csp() context p ... rocessor is configured, and an empty string otherwise. Use it in <script> or <link> elements to allow them under a nonce-based Content Security Policy: < script src = "/path/to/script.js" {% csp_nonce_attr %} ></ script > < link rel = "stylesh ... eet" href = "/path/to/style.css" {% csp_nonce_attr %} > When called with a Media object as the argument, renders its assets with the CSP nonce applied to each <script> ... ... ken ¶ このタグは CSRF の防止のために使用します。詳細は クロスサイトリクエストフォージェリ (CSRF) を参照してください。. csp_nonce_attr ¶ New in Django 6.1. When called without arguments, renders a nonce="<value>" HTML attribute when the csp() context p ... rocessor is configured, and an empty string otherwise. Use it in <script> or <link> elements to allow them under a nonce-based Content Security Policy: < script src = "/path/to/script.js" {% csp_nonce_attr %} ></ script > < link rel = "stylesh ... eet" href = "/path/to/style.css" {% csp_nonce_attr %} > When called with a Media object as the argument, renders its assets with the CSP nonce applied to each <script> ... ... rk and a system for preventing cross-site request forgery (CSRF) attacks . The CSRF-protection system is based on a random nonce sent to the client in a cookie which must be sent by the client on future requests and, in forms, a hidden value which mus ... ge is by a client which did not have a CSRF cookie, the cache framework will also cache the CSRF cookie and serve the same nonce to other anonymous clients who do not have a CSRF cookie. This can allow an attacker to obtain a valid CSRF cookie value a ... ... rk and a system for preventing cross-site request forgery (CSRF) attacks . The CSRF-protection system is based on a random nonce sent to the client in a cookie which must be sent by the client on future requests and, in forms, a hidden value which mus ... ge is by a client which did not have a CSRF cookie, the cache framework will also cache the CSRF cookie and serve the same nonce to other anonymous clients who do not have a CSRF cookie. This can allow an attacker to obtain a valid CSRF cookie value a ... 2026年10月08日