... s two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing ... . Each policy is composed of one or more directives and their values, which together instruct the browser on how to handle specific types of content. When the ContentSecurity ... immediate feedback during development. To also receive these reports programmatically, the policy must include a reporting directive such as report-uri that specifies where violation data should be sent. Django supports configuring these directives via the ... ... s two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing ... . Each policy is composed of one or more directives and their values, which together instruct the browser on how to handle specific types of content. When the ContentSecurity ... immediate feedback during development. To also receive these reports programmatically, the policy must include a reporting directive such as report-uri that specifies where violation data should be sent. Django supports configuring these directives via the ... ... cording to the Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when us ... (e.g. Private ). The cache_control() decorator and patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" accordi ... ission via STARTTLS in the SMTP backend CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization CVE-2026-48587: Potential exposure of p ... ... cording to the Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when us ... (e.g. Private ). The cache_control() decorator and patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" accordi ... ission via STARTTLS in the SMTP backend CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization CVE-2026-48587: Potential exposure of p ... ... cording to the Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when us ... (e.g. Private ). The cache_control() decorator and patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" accordi ... ission via STARTTLS in the SMTP backend CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization CVE-2026-48587: Potential exposure of p ... ... cording to the Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when us ... (e.g. Private ). The cache_control() decorator and patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" accordi ... ission via STARTTLS in the SMTP backend CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization CVE-2026-48587: Potential exposure of p ... ... two: from django.utils.csp import CSP # To enforce a CSP policy: SECURE_CSP = { "default-src" : [ CSP . SELF ], # Add more directives to be enforced. } # Or for report-only mode: SECURE_CSP_REPORT_ONLY = { "default-src" : [ CSP . SELF ], # Add more directi ... config, you need to: Include the NONCE placeholder value in the CSP settings. This only applies to script-src or style-src directives: from django.utils.csp import CSP SECURE_CSP = { "default-src" : [ CSP . SELF ], # Allow self-hosted scripts and script ta ... へ Django の CSRF 保護を利用する 関連キーワード nonce script attr style context template Content inline config more default directives path Nonce Security Policy middleware setting ContentSecurityPolicyMiddleware settings details utils import policy report ... ... two: from django.utils.csp import CSP # To enforce a CSP policy: SECURE_CSP = { "default-src" : [ CSP . SELF ], # Add more directives to be enforced. } # Or for report-only mode: SECURE_CSP_REPORT_ONLY = { "default-src" : [ CSP . SELF ], # Add more directi ... config, you need to: Include the NONCE placeholder value in the CSP settings. This only applies to script-src or style-src directives: from django.utils.csp import CSP SECURE_CSP = { "default-src" : [ CSP . SELF ], # Allow self-hosted scripts and script ta ... 連キーワード nonce csp script src attr django style your context template use Django Content Add inline config more default directives path 関連するページ コンテンツセキュリティポリシー How to use Django with Granian How to use Django with Granian How to re ... ... シー (Cross-Origin Opener Policy) ヘッダを設定します。 SECURE_CSP ¶ New in Django 6.0. Default: {} This setting defines the directives used by the ContentSecurityPolicyMiddleware , which generates and adds a Content-Security-Policy (CSP) header to all respo ... The setting must be a mapping (typically a dictionary) of directive names to their values. Each key should be a valid CSP directive such as default-src or script-src . The corresponding value can be a list, tuple, or set of source expressions or URLs to a ... rc" : [ CSP . SELF ], "img-src" : [ "data:" , CSP . SELF , "https://images.example.com" ], "frame-src" : [ CSP . NONE ], } Directives validation Django's CSP middleware helps construct and send the appropriate header based on your settings, but it does not ... ... d debugging. For configuration instructions, see the Using CSP documentation, and refer to the CSP overview for details on directives and settings. Limitations and considerations ¶ While CSP is a powerful security mechanism, it's important to understand it ... onments, measure the performance impact accordingly. Browser support: While CSP Levels 1 and 2 are widely supported, newer directives (CSP Level 3+) or complex policy behaviors may vary across browsers. Test your policy across the environments you intend t ... 2026年10月08日