Add upgrade-insecure-requests directive to report-only CSP

craigcook · Nov 26, 2024 · 50b0d3e · 50b0d3e
1 parent 3ee3e04
commit 50b0d3e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/bedrock/settings/__init__.py b/bedrock/settings/__init__.py
@@ -127,6 +127,7 @@
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["object-src"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["frame-ancestors"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["style-src"].remove(csp.constants.UNSAFE_INLINE)
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["upgrade-insecure-requests"] = True
 
 
 # `CSP_PATH_OVERRIDES` and `CSP_PATH_OVERRIDES_REPORT_ONLY` are mainly for overriding CSP settings