Add Django built-in CSP nonce support #2267
Merged
+62
−16
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Django 6.0 added built-in support for Content Security Policies. Part of this support is associating a randomly generated nonce to each request that can then be attached to <script> and <style> tags. django-debug-toolbar already has support for CSP nonces generated by the django-csp third-party lib but the nonces generated by django-csp and Django are accessed differently. This commit adds support for the CSP nonces generated by the built-in Django implementation.
matthiask
requested changes
Nov 27, 2025
Member
matthiask
left a comment
matthiask
left a comment
There was a problem hiding this comment.
Thanks! This looks very good.
Please change the CSP nonce import to use a django.VERSION comparison block so that we can automatically remove it in the future using django-upgrade (https://django-upgrade.readthedocs.io/en/latest/fixers.html#versioned-blocks)
Coverage report
Click to see where and how coverage changed
This report was generated by python-coverage-comment-action |
||||||||||||||||||||||||||||||||||||
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Django 6.0 added built-in support for Content Security Policies.
Part of this support is associating a randomly generated nonce to each request that can then be
attached to
<script>and<style>tags.If users of django-debug-toolbar want to have a nonce-based CSP, they need django-debug-toolbar to add the nonce to the
<script>and<style>tags that it generates.django-debug-toolbar already does that for CSP nonces generated by the django-csp third-party lib but the nonces generated by django-csp and Django are accessed differently.
This PR adds support for the CSP nonces generated by the built-in Django implementation.