Rely on django-csp's private attribute for nonce #2088
Conversation
This refactors how the CSP nonce is fetched. It's now done as a toolbar property and wraps the private attribute request._csp_nonce This avoids the toolbar from generating a nonce that gets injected into the CSP header when the view doesn't expect it to. It also supports using a nonce that is generated from any other point while processing the request, including other middleware.
| @@ -42,6 +42,11 @@ def regular_view(request, title): | |||
| return render(request, "basic.html", {"title": title}) | |||
|
|
|||
|
|
|||
| def csp_view(request): | |||
| """Use request.csp_nonce to inject it into the headers""" | |||
| return render(request, "basic.html", {"title": f"CSP {request.csp_nonce}"}) | |||
There was a problem hiding this comment.
The nonce needed to be rendered in the view. I chose to do it here.
| for middleware in [MIDDLEWARE_CSP_BEFORE, MIDDLEWARE_CSP_LAST]: | ||
| with self.settings(MIDDLEWARE=middleware): |
There was a problem hiding this comment.
It become important to test with both configurations of middleware. Or at least it will be more important if we stop relying on request._csp_nonce
|
The latest commit on django-csp changes the way nonce access is handled that may help this situation and not have to use the private attribute. If the nonce was used in the content it will still be available after the middleware has processed the response so other middleware can reference it. If the nonce was NOT used in the content it will raise the error, but also checking the nonce via You can see the changes in the PR: mozilla/django-csp#269 |
Description
This refactors how the CSP nonce is fetched. It's now done as a toolbar property and wraps the private attribute
request._csp_nonceThis avoids the toolbar from generating a nonce that gets injected into the CSP header when the view doesn't expect it to. It also supports using a nonce that is generated from any other point while processing the request, including other middleware.
Fixes #2082
Checklist:
docs/changes.rst.