Send Content-Security-Policy header

[thekaveman]

The Content-Security-Policy (CSP) header (with the frame-ancestors directive) replaces the now deprecated X-Frame-Options header, to instruct the browser about appropriate actions to perform if a site is included inside an <iframe>.

See more at https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

We already have Django's built-in Clickjacking/X-Frame-Options features enabled. Since this app should never be run from an <iframe>, let's create another Middleware that sets the CSP header like so:

Content-Security-Policy: default-src 'self'; frame-ancestors 'none';

[thekaveman]

Mozilla has helpfully implemented a Middleware that we can use for this!

https://github.com/mozilla/django-csp

https://django-csp.readthedocs.io/en/latest/