$ the-wire · showcase
DJANGO SHIPS CSP NONCE TAG AND FIXES ASGI AUTHENTICATION REGRESSION
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
3 people shipped this
Django merged three security and authentication fixes overnight that close gaps in ASGI middleware behavior and add a critical content security policy helper.
The headliner is a new `{% csp_nonce_attr %}` template tag [1] that handles CSP nonce injection explicitly — a cleaner pattern than the old workarounds for securing inline scripts and stylesheets. This ships alongside two authentication fixes that matter more than they first appear: Django 5.2 introduced a regression where RemoteUserMiddleware behaved differently under ASGI than WSGI [2] [3], forcing proxy operators to rewrite headers in incompatible ways. That's fixed now. The team also clarified the security posture of RemoteUserMiddleware itself , tightening documentation around header spoofing risks. A fourth commit [4] stages test infrastructure for incoming email provider integrations, suggesting a larger feature is landing in the next cycle. All four are cherry-picks or targeted fixes — no breaking changes, all backport candidates.
Action items
- → Review RemoteUserMiddleware configuration if running ASGI in production — verify header names match documented format django/django [plan]
- → Adopt {% csp_nonce_attr %} in templates using inline scripts — removes need for manual context injection django/django [monitor]
- → Watch djangoproject.com for playwright test suite rollout — regression tests are failing as expected django/djangoproject.com [monitor]
References
- [1] Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion. ↗ django/django
- [2] Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI. ↗ django/django
- [3] Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI. ↗ django/django
- [4] Refs #35514 -- Prepared for email providers. ↗ django/django
