... ject, see the Using CSP documentation. For an HTTP guide about CSP, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that ... violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is composed ... and their values, which together instruct the browser on how to handle specific types of content. When the ContentSecurityPolicyMiddleware is enabled, Django automatically builds and attaches the appropriate headers to each response based on the confi ... ... ject, see the Using CSP documentation. For an HTTP guide about CSP, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that ... violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is composed ... and their values, which together instruct the browser on how to handle specific types of content. When the ContentSecurityPolicyMiddleware is enabled, Django automatically builds and attaches the appropriate headers to each response based on the confi ... ... す: Add the CSP middleware to your MIDDLEWARE setting: MIDDLEWARE = [ # ... "django.middleware.csp.ContentSecurityPolicyMiddleware" , # ... ] Configure the CSP policies in your settings.py using either SECURE_CSP or SECURE_CSP_REPORT_ONLY (or ... ngs docs provide more details about the differences between these two: from django.utils.csp import CSP # To enforce a CSP policy: SECURE_CSP = { "default-src" : [ CSP . SELF ], # Add more directives to be enforced. } # Or for report-only mode: SECURE_ ... # Add more directives as needed. "report-uri" : "/path/to/reports-endpoint/" , } Nonce config ¶ To use nonces in your CSP policy, beside the basic config, you need to: Include the NONCE placeholder value in the CSP settings. This only applies to scrip ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... ... す: Add the CSP middleware to your MIDDLEWARE setting: MIDDLEWARE = [ # ... "django.middleware.csp.ContentSecurityPolicyMiddleware" , # ... ] Configure the CSP policies in your settings.py using either SECURE_CSP or SECURE_CSP_REPORT_ONLY (or ... ngs docs provide more details about the differences between these two: from django.utils.csp import CSP # To enforce a CSP policy: SECURE_CSP = { "default-src" : [ CSP . SELF ], # Add more directives to be enforced. } # Or for report-only mode: SECURE_ ... # Add more directives as needed. "report-uri" : "/path/to/reports-endpoint/" , } Nonce config ¶ To use nonces in your CSP policy, beside the basic config, you need to: Include the NONCE placeholder value in the CSP settings. This only applies to scrip ... ... ed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicat ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... , all untrusted user input should be validated before use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text ... 2026年10月08日