Implement newsletter double opt-in email flow and CSP nonce headers

apps/core/middleware.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import secrets
+
 from .consent import ConsentService
 
 
@@ -10,3 +12,26 @@ class ConsentMiddleware:
     def __call__(self, request):
         request.consent = ConsentService.get_consent(request)
         return self.get_response(request)
+
+
+class SecurityHeadersMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        nonce = secrets.token_urlsafe(16)
+        request.csp_nonce = nonce
+        response = self.get_response(request)
+        response["Content-Security-Policy"] = (
+            f"default-src 'self'; "
+            f"script-src 'self' 'nonce-{nonce}'; "
+            "style-src 'self'; "
+            "img-src 'self' data: blob:; "
+            "font-src 'self'; "
+            "connect-src 'self'; "
+            "object-src 'none'; "
+            "base-uri 'self'; "
+            "frame-ancestors 'self'"
+        )
+        response["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        return response