[Solved] You added this line in your Django middleware but the CSP header is not appearing in responses:request['Content-Security-Policy'] = "default-src 'self'"What is the error? | Django

Django - Security Best Practices

You added this line in your Django middleware but the CSP header is not appearing in responses:

request['Content-Security-Policy'] = "default-src 'self'"

What is the error?

AThe header name is misspelled

BHeaders must be set on the response object, not request

CThe CSP value syntax is invalid

DMiddleware must return request, not response

Step-by-Step Solution

Solution:

Step 1: Identify where headers belong
HTTP headers are part of the response, so they must be set on the response object.
Step 2: Recognize the mistake in code
Setting header on request object does nothing for response headers.
Final Answer:
Headers must be set on the response object, not request -> Option B
Quick Check:
Set headers on response, not request [OK]

Quick Trick: Set CSP header on response, not request [OK]

Common Mistakes:

MISTAKES

Master "Security Best Practices" in Django

9 interactive learning modes - each teaches the same concept differently

More Django Quizzes

You added this line in your Django middleware but the CSP header is not appearing in responses: