Django's Built-In CSP: What 6.0 Shipped and 6.1 Fixed
Dev Communityvia NewsData.io
The admin login page came up with no styling and no JavaScript. The console was a wall of Refused to load the script errors, every one of them pointing at something under /static/admin/js/. An hour earlier I had added nine lines to settings.py on a Django 6.0 project to turn on a nonce-based Content Security Policy. The policy was fine. The admin templates were the problem, and that turned out to be a known bug rather than my mistake. If you are adopting the CSP support Django now ships in core, that is the shape of the first afternoon. The settings are genuinely simple. The surprises are all
Headline and summary provided via NewsData.io. The full article and its copyright belong to the original publisher.