Enable content security policy in report-only mode

readthedocs/settings/base.py

@@ -77,6 +77,18 @@ class CommunityBaseSettings(Settings):
     SECURE_CONTENT_TYPE_NOSNIFF = True
     X_FRAME_OPTIONS = 'DENY'
 
+    # Content Security Policy
+    # https://django-csp.readthedocs.io/
+    CSP_BLOCK_ALL_MIXED_CONTENT = True
+    CSP_DEFAULT_SRC = None  # This could be improved
+    CSP_FRAME_ANCESTORS = ("'none'",)
+    CSP_OBJECT_SRC = ("'none'",)
+    CSP_REPORT_URI = None
+    CSP_REPORT_ONLY = True  # Set to false to enable CSP in blocking mode
+    CSP_EXCLUDE_URL_PREFIXES = (
+        "/admin/",
+    )
+
     # Read the Docs
     READ_THE_DOCS_EXTENSIONS = ext
     RTD_LATEST = 'latest'
@@ -180,6 +192,7 @@ def USE_PROMOS(self):  # noqa
         'readthedocs.core.middleware.SubdomainMiddleware',
         'readthedocs.core.middleware.SingleVersionMiddleware',
         'corsheaders.middleware.CorsMiddleware',
+        'csp.middleware.CSPMiddleware',
     )
 
     AUTHENTICATION_BACKENDS = (

readthedocs/settings/proxito.py

@@ -29,7 +29,15 @@ def MIDDLEWARE(self):  # noqa
             'readthedocs.core.middleware.SubdomainMiddleware'
         )
         classes[index] = 'readthedocs.proxito.middleware.ProxitoMiddleware'
-        classes.remove('readthedocs.core.middleware.SingleVersionMiddleware')
+
+        middleware_to_remove = (
+            'readthedocs.core.middleware.SingleVersionMiddleware',
+            'csp.middleware.CSPMiddleware',
+        )
+        for mw in middleware_to_remove:
+            if mw in classes:
+                classes.remove(mw)
+
         return classes
 
 

requirements/pip.txt

@@ -113,3 +113,6 @@ azure-storage-common==1.4.2
 
 # Required only in development and linting
 django-debug-toolbar==2.0
+
+# For enabling content-security-policy
+django-csp==3.6