add django_csp and settings

weni-ai · May 12, 2022 · 99fcce7 · 99fcce7
1 parent ba953a6
commit 99fcce7
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 1 deletion.
diff --git a/bothub/settings.py b/bothub/settings.py
@@ -144,13 +144,15 @@
     "whitenoise.middleware.WhiteNoiseMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.locale.LocaleMiddleware",
+    "csp.middleware.CSPMiddleware",
     "corsheaders.middleware.CorsMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "bothub.api.v2.middleware.UserLanguageMiddleware",
+
 ]
 
 ROOT_URLCONF = "bothub.urls"
@@ -299,6 +301,13 @@
 CSRF_COOKIE_SECURE = env.bool("CSRF_COOKIE_SECURE")
 
 
+# CSP headers
+
+CSP_DEFAULT_SRC = ("'self'", '*')
+
+CSP_FRAME_ANCESTORS = ["'self'", "*.weni.ai"]
+
+
 # Logging
 
 LOGGING = DEFAULT_LOGGING

diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -52,6 +52,7 @@ psycopg2-binary = "~=2.9.1"
 weni-protobuffers = "~=1.2.1"
 black = "21.7b0"
 Pillow = "~=8.4.0"
+django-csp = "^3.7"
 
 [tool.poetry.dev-dependencies]
 flake8 = "~=4.0.0"