`CSP_INCLUDE_NONCE_IN` not working? about django-csp HOT 4 CLOSED

It looks like the nonce does not get sent in the header if no nonce is being evaluated in your template. Once my template was evaluating a nonce, things work as expected. Perhaps the docs should be updated to reflect this? I'd be happy to give it a shot if folks are open to it.

from django-csp.

Thanks for opening this issue. Was hit with the exact same one today.

from django-csp.

Took a stab at a PR here.

I wonder if it makes sense to change this behaviour slightly though as it seems somewhat unsafe. If the nonce isn't used and it's not going to be included in the header, shouldn't the source list be set to 'none'?

from django-csp.

It might be because of the middleware SimpleLazyObject. The SimpleLazyObject may not be properly calling the _make_nonce method. To fix this, you can change the process_request method to directly call the _make_nonce method:

class CSPMiddleware(MiddlewareMixin):
    def _make_nonce(self, request):
        if not getattr(request, '_csp_nonce', None):
            request._csp_nonce = (
                base64
                .b64encode(os.urandom(16))
                .decode("ascii")
            )
        return request._csp_nonce

    def process_request(self, request):
        request.csp_nonce = self._make_nonce(request)

    # rest of the code remains unchanged

from django-csp.