Package: pyramid-csp
pyramid-csppyramid-cspis a simple Pyramid add-on for adding aContent-Security-Policyheader your HTTP responsesFor more information on Content Security Policies, seehttps://content-security-policy.com/SetupThere are two ways of includingpyramid-cspin your application:The first is addingpyramid_cspto thepyramid.includessection of your application settings.[app:main]
pyramid.includes = pyramid_cspThe second is using theConfigurator.includefunction.config.include("pyramid.csp")Basic UsageThe most basic usage ofpyramid-cspis to set thecsp.policysetting.
This setting should be a valid CSP and will be added to the response headers.[app:main]
csp.policy = default-src https://example.com>> curl -i http://localhost:8000
...
Content-Security-Policy: default-src https://example.com
...You can also create a policy by programmatically adding sources with theadd_csp_sourceconfiguration method.
(This will work in addition to thecsp.policysetting.)
The first argument is the directive nameconfig.add_csp_source("default-src","'self'")>> curl -i http://localhost:8000
...
Content-Security-Policy: default-src https://example.com 'self'
...The request object also contains anadd_csp_sourcemethod,
which works the same as the configurator method but will only add the source for that request.defmyview(context,request):nonce=secrets.token_urlsafe()request.add_csp_source("default-src",f"'nonce-{nonce}'")returnResponse(body="<h1>Hello</h1>",content_type="text/html")Note:If no sources are defined for thedefault-srcdirective,'none'is automatically added.Preset Sourcespyramid-srcprovides theCSPSourcesobject, which contains several preset sources.
For example:frompyramid_cspimportCSPSourcesdefincludeme(config):config.add_csp_source("default-src",CSPSources.UNSAFE_EVAL)TheCSPSourcesobject has the following properties:WILDCARD—*NONE—'none'SELF—'self'DATA—data:HTTPS—https:UNSAFE_INLINE—'unsafe-inline'UNSAFE_EVAL—'unsafe-eval'STRICT_DYNAMIC—'strict-dynamic'UNSAFE_HASHES—'unsafe-hashes'The object also offers several methods for generating sources:https(domain)—https://{domain}nonce(nonce)—'nonce-{nonce}'hash(alg, h)—'{alg}-{h}'(hshould be a binary hash digest or a base64-encoded string.
If binary, it will be base64-encoded.)sha256(h)—'sha256-{h}'sha384(h)—'sha384-{h}'sha512(h)—'sha512-{h}'Noncespyramid-cspadds acsp_nonceproperty to the request object,
containing a crytographically secure random nonce token.
If accessed, the nonce token will be added to the CSP.defmyview(context,request):body='<script nonce="{ request.csp_nonce }">alert("Hello!");</script>'returnResponse(body=body,content_type="text/html")>> curl -i http://localhost:8000/
...
Content-Security-Policy: default-src 'nonce-ZtynG2MXgOPkqWgHyqf8wrR8jOeprIA2qDMKJuOfEXw'
...
<script nonce="ZtynG2MXgOPkqWgHyqf8wrR8jOeprIA2qDMKJuOfEXw">alert("Hello!")</script>By default, the nonce will only be added to thedefault-srcdirective.
To add it to a different directive, use thecsp.nonce_directivessetting.
Multiple directives can be separated with a comma.[app:main]
csp.nonce_directives = script-src, style-srcdefmyview(context,request):body='<script nonce="{ request.csp_nonce }">alert("Hello!");</script>'returnResponse(body=body,content_type="text/html")>> curl -i http://localhost:8000/
...
Content-Security-Policy: default-src 'none'; script-src 'nonce-vyjGpdvTnH6x7-eL-RvVMmxx4KNMTfX9WoLdmgijv2c'; script-src 'nonce-vyjGpdvTnH6x7-eL-RvVMmxx4KNMTfX9WoLdmgijv2c'
...
<script nonce="vyjGpdvTnH6x7-eL-RvVMmxx4KNMTfX9WoLdmgijv2c">alert("Hello!")</script>For more information CSP nonces, seehttps://content-security-policy.com/nonce/