django-csp

What it is and what it does

Django-CSP is a middleware package that automatically injects Content-Security-Policy headers into Django HTTP responses. It lets you define a security policy that tells browsers which origins are allowed to load scripts, stylesheets, images, and other resources, helping prevent cross-site scripting (XSS) and other injection attacks. The package wraps around Django and works with the packaging library to manage policy directives.

You configure policies in Django settings and the middleware applies them to all responses. It supports both report-only mode (for testing policies without enforcing them) and enforcement mode, and integrates cleanly into the Django request/response cycle without requiring changes to your views or templates.

Use it for:

• Prevent XSS attacks by restricting script execution to trusted origins only.
• Enforce HTTPS for all resources to block mixed-content vulnerabilities.
• Report policy violations to a logging endpoint for security monitoring.
• Gradually roll out stricter policies using report-only mode before enforcement.
• Isolate third-party widget code by restricting its access to the page DOM.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Django-CSP adds Content-Security-Policy headers to Django applications, enabling you to define and enforce browser security policies that control which resources can be loaded.

Yes. Django-CSP is a stable, low-friction way to add a critical security layer to Django applications. It has no known vulnerabilities, permissive licensing, and broad Django version support. The aging maintenance status is not a blocker—the package is mature and the 499-day release gap may reflect stability rather than abandonment. Install it if you need CSP header management in Django.

Install

django-csp on PyPI

pip install django-csp

uv add django-csp

poetry add django-csp

Installing django-csp

Before you install

Low install friction with only two runtime dependencies (django and packaging). Maintenance status is aging—last commit was 2025-11-14 and no release in 499 days—but the package is marked Production/Stable and remains actively used.

License in practice

BSD license is permissive, allowing commercial and private use with minimal restrictions; you may use and modify the package freely as long as you include the license notice.

Quickstart

pip install django-csp

# In Django settings.py, add to MIDDLEWARE:
MIDDLEWARE = [
    'csp.middleware.CSPMiddleware',
]

# Define CSP policy:
CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'")

Verify before relying

• Whether the 499-day gap since last release indicates maintenance concerns or stable maturity for this use case.
• Compatibility with Django versions beyond 5.2 and Python versions beyond 3.13.

Package facts

Evidence: django_csp-4.0-py3-none-any.whl

Tags

More Python Modules packages