Django - Security Best Practices
How can you dynamically add a nonce value to your Django CSP header to allow inline scripts safely?
How can you dynamically add a nonce value to your Django CSP header to allow inline scripts safely?
hard📝 Application Q9 of 15
Step-by-Step Solution
Solution:
Step 1: Understand nonce usage in CSP
A nonce is a random token generated per request to allow specific inline scripts safely.Step 2: Implement nonce in Django
Generate a random nonce in middleware, add it to CSP header as 'nonce-', and add same nonce to inline script tags. Step 3: Avoid unsafe-inline and fixed nonce
Using 'unsafe-inline' disables CSP protection; fixed nonce defeats security purpose.Final Answer:
Generate a random nonce per request and include it in the CSP header and script tags -> Option BQuick Check:
Dynamic nonce per request = Generate a random nonce per request and include it in the CSP header and script tags [OK]
Quick Trick: Use dynamic nonce per request for safe inline scripts [OK]
Common Mistakes:
MISTAKES- Using 'unsafe-inline' which weakens security
- Hardcoding nonce value
- Removing script-src directive entirely
Master "Security Best Practices" in Django
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Django Quizzes