Skip to content

Consolidate csp_nonce usages to a single property on the toolbar. #2099

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 14, 2025
Merged

Consolidate csp_nonce usages to a single property on the toolbar. #2099

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78df1d0
Consolidate csp_nonce usages to a single property on the toolbar.
tim-schilling Mar 8, 2025
e98df93
Unpin django-csp for tests.
tim-schilling Mar 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions debug_toolbar/toolbar.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,10 @@ def csp_nonce(self):
have a nonce associated with the request. Use the private attribute
because the lazy object wrapped value can generate a nonce by
accessing it. This isn't ideal when the toolbar is injecting context
into the response because it may set a nonce that is not used with
into the response because it may set a nonce not used with
other assets.
"""
return getattr(self.request, "_csp_nonce", None)
return getattr(self.request, "csp_nonce", None)

def get_panel_by_id(self, panel_id):
"""
Expand Down
2 changes: 1 addition & 1 deletion docs/changes.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Pending
or ``async_to_sync`` to allow sync/async compatibility.
* Make ``require_toolbar`` decorator compatible to async views.
* Added link to contributing documentation in ``CONTRIBUTING.md``.
* Rely on django-csp's private attribute for nonce, ``request._csp_nonce``.
* Create a CSP nonce property on the toolbar ``Toolbar().csp_nonce``.

5.0.1 (2025-01-13)
------------------
Expand Down
2 changes: 1 addition & 1 deletion tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ deps =
pygments
selenium>=4.8.0
sqlparse
django-csp<4
django-csp
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the django-csp v4 releases are beta, a pre-release, will this pick up v3.8, the last published release? I'm not up on if the intention here is to test against v4 or v3.x but I believe django-csp has solved this issue for both versions anyway by adding the CheckableLazyObject in the v4 betas.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we test against pre-releases in ci. I think that's why we caught this early.

passenv=
CI
COVERAGE_ARGS
Expand Down