43594777e0
The SecurityHeadersMiddleware applied a strict style-src policy to all responses, blocking inline styles that Wagtail admin relies on for layout. Skip the custom CSP for /cms/ and /django-admin/ paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
42 lines
1.3 KiB
Python
42 lines
1.3 KiB
Python
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from .consent import ConsentService
|
|
|
|
|
|
class ConsentMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
request.consent = ConsentService.get_consent(request)
|
|
return self.get_response(request)
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
ADMIN_PREFIXES = ("/cms/", "/django-admin/")
|
|
|
|
def __call__(self, request):
|
|
nonce = secrets.token_urlsafe(16)
|
|
request.csp_nonce = nonce
|
|
response = self.get_response(request)
|
|
if request.path.startswith(self.ADMIN_PREFIXES):
|
|
return response
|
|
response["Content-Security-Policy"] = (
|
|
f"default-src 'self'; "
|
|
f"script-src 'self' 'nonce-{nonce}'; "
|
|
"style-src 'self' https://fonts.googleapis.com; "
|
|
"img-src 'self' data: blob:; "
|
|
"font-src 'self' https://fonts.gstatic.com; "
|
|
"connect-src 'self'; "
|
|
"object-src 'none'; "
|
|
"base-uri 'self'; "
|
|
"frame-ancestors 'self'"
|
|
)
|
|
response["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
|
|
return response
|