CSP

[snmishra]

Is it possible to use django-unicorn with strict CSP?

[adamghill]

It's not currently possible, but reading through https://web.dev/strict-csp/ I think I understand how to implement for django-unicorn.
I can add a nonce to each script that gets rendered to the page and add a middleware to add the header in... would there be more to it then that?

Other questions: Do you currently use a Django package that implements CSP? Do you use https://django-csp.readthedocs.io/? Anything else I should look out for?

[snmishra]

Thanks for looking into this. django-csp is indeed what I'm using to implement CSP (you can do it without, I think, but more work).

I'm no expert on CSP, but from what I understand nonce alone will not be enough. nonce or hash will help with inline scripts. But it won't help with strings that are evaled or converted into functions. Only function names can be specified in strings, but the function has to be defined statically in separate JS file.