Change Content-Security-Policy header from plugin

[Findus23]

Hello everyone,

I am trying to add Matomo to a pretalx site and with the pretalx.cfp.signals.html_head signal it is easy to add the Javascript. But in addition I need to update the CSP header to also allow loading Javascript from this separate host.

What is the easiest way to accomplish this (either in the plugin or in pretalx itself).

Editing

pretalx/src/pretalx/settings.py

Line 133 in f2e0cee

CSP_DEFAULT_SRC = "'self'"

would work, but doesn't seem ideal to me.

[rixx]

Since this is the first request for this (and I'm lazy), you're getting a slightly different solution for now: I added a configuration option to pretalx to expand the CSP headers. Added and documented here: 0bbc718

[Findus23]

That's an even better solution. In the meantime I solved it for my site by changing the values in settings.py directly.