CSP issues

Whilst in the process of adding a Content Security Policy to a Wagtail site I found that the Pattern Library is not compliant. I raised this issue to request that the Pattern Library be made CSP compliant.

Working on the philosophy that a weak CSP is better than no CSP I have added some custom middleware to get around the issue, please see an example below:

class CSPOverrideMiddleware(MiddlewareMixin):
    """
    Custom middleware to override Content Security Policy directives.
    Add to MIDDLEWARE list after official django-csp CSPMiddleware.
    """

    def process_request(self, request):
        prefix = ("/pattern-library")
        if request.path_info.startswith(prefix):
            # Remove nonce value otherwise 'unsafe-inline' will not work.
            request.csp_nonce = None

    def process_response(self, request, response):
        # Add CSP sources to enable pages to work.
        if request.path_info.startswith("/pattern-library"):
            response._csp_update = {
                "style-src": "'unsafe-inline'",
                "script-src": "'unsafe-inline'",
                "img-src": "https://via.placeholder.com",
            }

        return response

Still in the process of testing but adding here to share the general approach for a (hopefully) temporary workaround. Thanks.

The issue does not name files, tests, or an entry point. Start by reproducing the Pattern Library under the reported Content Security Policy and compare the violations with the requested compliant behavior; done means it works without the temporary middleware workaround.