Allow certain URLs to be exempted from 'strict-dynamic'

[mark-adams]

In a Django application, there are often certain views that are not controlled by the developer (such as the Django admin). For those of us using 'strict-dynamic' in our CSP policies, the only real option currently is to whitelist these URLs (which is very undesirable).

It is also common to have fallback CSP policies for when a user agent doesn't support strict-dynamic. An example policy would be 'strict-dynamic' 'unsafe-inline' 'self' 'http:' 'https'. With this policy, a CSP 3.x compatible browser would ignore unsafe-inline, self, http:, and https: and only obey strict-dynamic while older browsers would ignore strict-dynamic and follow the policy in the other directives.

It would be nice to define some sort of settings.CSP_BYPASS_STRICT_DYNAMIC value that would exclude views from having strict-dynamic applied to their CSP policy while leaving the other fallback directives alone. That way, views that the developer does not control (like Django admin) would have at least some benefit from CSP.

[g-k]

@mark-adams Thanks for raising this! If I'm understanding this correctly, you want to set a different CSP policy (including or excluding the 'strict-dynamic' script-src) for views you didn't write instead of excluding them from the CSP header entirely.

Possible options:

• Use the csp_replace decorator for admin-specific CSP. Roughly:

# urls.py
from django.contrib import admin
from django.urls import path

from csp.decorators import csp_replace

urlpatterns = [
    path('admin/', csp_replace(SCRIPT_SRC="'self'")(admin.site.urls),
]

• Subclass csp.middleware.CSPMiddleware and override process_request to handle admin URLs differently as described here

• Have a CDN, reverse proxy, or something in front of the app set a second CSP header as described here (NB: django-csp doesn't support multiple headers but should for Allow enforced CSP and Report-Only at the same time #36)

• Use the csp_update decorator to add 'strict-dynamic' or other sources to certain views

Am I understanding the problem correctly? Would any of those options work?

[g-k]

Closing since this is really old and I think I addressed it in my last comment, but happy to revisit later.

[anuj9196]

csp_replace in URL is not working.

[programanX]

I also stumbled on this.

Since admin.site.urls is a tupple, not a callable, you have to treat it like include.
So, install django-decorator-include and try below:

from csp.decorators import csp_replace
from decorator_include import decorator_include

urlpatterns = [
    path("admin/", decorator_include(csp_replace(SCRIPT_SRC="'self'"), admin.site.urls)),
    ...