Content Security Policy in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add a Content Security Policy header in Django middleware.

Django

response["Content-Security-Policy"] = [1]

Drag options to blanks, or click blank then click option'

A"img-src 'unsafe-inline'"

B"script-src 'none'"

C"default-src 'self'"

D"allow-all"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allow-all' which is not a valid CSP directive.

Using 'unsafe-inline' without understanding risks.

The Content Security Policy header should specify allowed sources. "default-src 'self'" restricts content to the same origin, which is a common safe default.

2fill in blank

medium

Complete the middleware method to set the CSP header on the response.

Django

def __call__(self, request):
    response = self.get_response(request)
    response["Content-Security-Policy"] = [1]
    return response

Drag options to blanks, or click blank then click option'

A"default-src 'self'"

B"default-src 'none'"

C"script-src 'unsafe-inline'"

D"img-src *"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'unsafe-inline' which weakens security.

Allowing all images with '*' which is too permissive.

Setting the header to "default-src 'self'" allows resources only from the same origin, which is a secure default.

3fill in blank

hard

Fix the error in this CSP header assignment to allow scripts only from the same origin.

Django

response["Content-Security-Policy"] = [1]

Drag options to blanks, or click blank then click option'

A"default-src 'self'"

B"script-src self"

C"script-src 'unsafe-inline'"

D"script-src 'self'"

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting quotes around 'self' causing invalid CSP.

Using 'unsafe-inline' which is less secure.

The correct syntax requires quotes around 'self' in the directive. Without quotes, the policy is invalid.

4fill in blank

hard

Fill both blanks to create a CSP that allows images from the same origin and scripts only from trusted.com.

Django

response["Content-Security-Policy"] = [1] + "; " + [2]

Drag options to blanks, or click blank then click option'

A"img-src 'self'"

B"script-src 'self'"

C"script-src https://trusted.com"

D"img-src *"

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing images from all sources with '*'.

Using 'script-src' with 'self' instead of the trusted domain.

The policy allows images only from the same origin and scripts only from https://trusted.com.

5fill in blank

hard

Fill all three blanks to build a CSP that allows styles from 'self', scripts from trusted.com, and blocks all frames.

Django

response["Content-Security-Policy"] = [1] + "; " + [2] + "; " + [3]

Drag options to blanks, or click blank then click option'

A"style-src 'self'"

B"script-src https://trusted.com"

C"frame-src 'none'"

D"img-src 'self'"

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing frames by omitting 'frame-src' or setting it too permissively.

Using incorrect quotes or missing quotes around 'self' or 'none'.

This CSP allows styles only from the same origin, scripts only from trusted.com, and blocks all frames by setting frame-src to 'none'.