Content Security Policy in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Content Security Policy (CSP)?

Content Security Policy is a security feature that helps prevent attacks like cross-site scripting (XSS) by controlling which resources (scripts, styles, images) a web page can load.

intermediate

How do you add a Content Security Policy header in Django?

You can add CSP headers in Django by using middleware or third-party packages like django-csp, which lets you define policies in your settings to control resource loading.

beginner

What does the directive script-src 'self' mean in a CSP?

It means the page is only allowed to load and run scripts that come from the same origin (domain) as the page itself, blocking scripts from other sources.

intermediate

Why is it important to avoid using unsafe-inline in CSP?

Using unsafe-inline allows inline scripts, which can open doors to XSS attacks. Avoiding it makes your site safer by only allowing trusted external scripts.

beginner

Name a common Django package used to implement CSP easily.

The package django-csp is commonly used to add and manage Content Security Policy headers in Django projects.

What is the main purpose of Content Security Policy in Django?

A To control which resources the browser can load to improve security

B To speed up page loading by caching resources

C To style the webpage with CSS

D To manage user authentication

CSP controls resource loading to prevent attacks like cross-site scripting.

Which directive restricts where scripts can be loaded from in CSP?

A style-src

B img-src

C script-src

D connect-src

The script-src directive controls allowed sources for scripts.

In Django, which method is commonly used to add CSP headers?

A Writing CSP in templates only

B Adding CSP in models.py

C Using Django admin panel settings

D Using middleware or django-csp package

Middleware or django-csp package is used to add CSP headers in Django.

What risk does allowing unsafe-inline scripts in CSP introduce?

A Cross-site scripting (XSS) attacks

B Slower page load times

C Broken images

D Authentication failures

Allowing unsafe-inline scripts can lead to XSS attacks.

Which of these is NOT a valid CSP directive?

A font-src

B data-src

C img-src

D media-src

There is no 'data-src' directive in CSP.

Explain how Content Security Policy helps protect a Django web application.

Think about what kinds of attacks CSP blocks and how it tells the browser what is safe.

Describe how to implement a basic Content Security Policy in a Django project.

Focus on the steps from installing a package to setting rules.