[Fixed]-Django , Content Security Policy directive

Protecting a django app with a Content Security Policy is pretty straight forward and in your case the header should looks something like this:

Content-Security-Policy: default-src 'none'; script-src 'self' www.google-analytics.com; connect-src 'self'; img-src 'self' www.google-analytics.com; style-src 'self' fonts.googleapis.com; font-src 'self' fonts.gstatic.com;

1. pip install django-csp
2. adjust your project’s settings module to add the “django-csp” middleware to your middleware classes
3. add the above CSP header

Some more resources:

http://django-csp.readthedocs.io/en/latest/

https://www.templarbit.com/blog/2018/06/14/content-security-policy-with-django

That is from the browser in HTML5. Here’s a good article on how to fix it in your headers:

http://www.html5rocks.com/en/tutorials/security/content-security-policy/

There’s also a Django app for handling this header:

http://django-csp.readthedocs.org/en/latest/configuration.html

Good luck!