Add a Content-Security-Policy in Report-Only mode (refs #3041)

[tonghuaroot]

Part of #3041 (adds the CSP in Report-Only mode; enforcing and origin tuning to follow).

What this does

www.python.org currently sends no Content-Security-Policy header. This adds one via django-csp as defense-in-depth against XSS.

It ships in Report-Only mode: responses carry Content-Security-Policy-Report-Only and no enforcing Content-Security-Policy, so nothing is blocked for users. The point of this first step is to collect violation reports and tune the allowlist before switching to an enforced policy.

Changes

• pyproject.toml / uv.lock: add django-csp==4.0.
• pydotorg/settings/base.py:
  • add csp.middleware.CSPMiddleware to MIDDLEWARE, alongside the existing XFrameOptionsMiddleware (which is how the site already sets a security header from Django).
  • add a CONTENT_SECURITY_POLICY_REPORT_ONLY policy with a strict starting set of directives.

Starting policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:;
font-src 'self'; connect-src 'self'; frame-ancestors 'self'; base-uri 'self';
object-src 'none'; form-action 'self'

These are intentionally strict so the Report-Only telemetry surfaces every inline script/style and third-party origin that needs a nonce, hash, or allowlist entry. Follow-ups from #3041: add a report endpoint, tune the origins, wire nonces into the base templates, then flip Report-Only to enforcing.

Verification

Smoke-tested the config against django-csp 4.0 in isolation: it emits the Content-Security-Policy-Report-Only header with the directives above and no enforcing Content-Security-Policy header, so pages are never blocked.

[sethmlarson]

Thanks, two comments:

[sethmlarson]

Add a comment to remove this and our dependency on django-csp when we upgrade to Django 6.0.

[tonghuaroot]

Done, added a note to drop django-csp once we move to Django 6.0.

[sethmlarson]

Can we add a test case that checks which HTTP header is emitted? Want to make sure Content-Security-Policy-Report-Only is emitted, not Content-Security-Policy so we don't break everyone on rollout.

[tonghuaroot]

Added a test that checks the Report-Only header is set and the enforcing one is not. Runs green.

[sethmlarson]

@tonghuaroot Are you still interested in landing this PR?

[tonghuaroot]

Yes, still keen to land it. Pushed both of your changes and it's ready for another look.