Package: django-csp-observer
CSP ObserverCSP Observer is a Django app that monitors incoming Content Security Policy (CSP) reports for your site. It tries to detect security/privacy issues and notifies your visitors.InstallationInsettings.pyadd "csp_observer" to yourINSTALLED_APPS:INSTALLED_APPS = [
    ...
    'csp_observer',
]Also insettings.pyadd the following entry toMIDDLEWARE:MIDDLEWARE = [
    ...
    'csp_observer.middleware.CspReportMiddleware',
]Please make sure that it is the last entry in the middlewares, otherwise another installed middleware could interfere with the operation of CSP Observer.Include the url configuration in yoururls.py:from django.urls import path, include

urlpatterns = [
    ...
    path('csp/', include('csp_observer.urls')),
]You can change this path but keep in mind, that this path determines the access URL to the admin dashboard. Example: If you change the path for CSP Observer topath('cspobserver/', ...), the admin dashboard will now be accessible at/cspobserver/admin.Runpython manage.py migrateto create the necessary database tables.The basic installation is finished! View theConfigurationsection for more information on how to configure the app.Admin InterfaceA basic administration interface is available under/csp/adminCommandsList of commands integrated intomanage.py:CommandDescriptioncleanunusedRemoves old sessions and reports from the database. Should be run regularly.updaterulesUpdates the rules from the central rule repository.ConfigurationOverview of all available settings and their default values:SettingDefaultDescriptionREPORT_ONLYTrueWether to enforce the CSP rules or only report them.ENABLED_PATHS["/"]An array of paths for which the CSP header should be set.CSP_POLICIES{'default-src': ["'self'"],'script-src': ["'self'", "'unsafe-inline'"],'connect-src': ["'self'"],}A disctionary of CSP policies that should be applied. Key is the name of the directive and value is a list of expressions.USE_NEW_APIFalseWhether to enable the new Reporting API or use the old report-uri directiveUSE_SCRIPT_NONCETrueAdd nonce to all script tags to catch inline script violationsUSE_STYLE_NONCETrueAdd nonce to all style tags to catch inline style violationsSESSION_KEEP_DAYS14The number of days sessions should be kept in the database.IS_MASTER_COLLECTORFalseIndicates if the instance should function as a central collector of CSP reports for multiple other instances.AUTHORIZED_REPORTERS[]A list of domains that are allowed send their CSP reports to the master. Example:['http://127.0.0.1:8000', 'https://example.com']REMOTE_SECRET''A shared secret thatmust be the samefor the master collector and all reporters.REMOTE_REPORTINGFalseWether to use a central remote collector or not.REMOTE_CSP_OBSERVER_URL''The URL of the remote collector instance. Must be the path to thecsp_observerapp, as defined inurls.py. Example:http://example.com/cspCLIENTUI_VISIBILITYalwaysChoose if the client popup should always be visible (always) or only if a problem has been detected (minimized)RULE_UPDATE_FILEhttps://raw.githubusercontent.com/flxn/csp-observer-data/master/rules.jsonThe path to the file that contains the global rule databaseRULE_UPDATE_INTERVAL21600The minimum number of seconds before a new rule update is allowedVOLUNTARY_DATA_SHARING_URLhttps://csp-observer-reports.flxn.deThe URL that the unknown report data of the data sharing is sent to.