Django CSP

[okaycj]

This is for Issue #1083

From the security review, it was requested to add CSP to our site. This for of protection will allow us to limit what is able to be loaded/executed on our site.

The Django-CSP has been added and implemented. The following has yet to be completed:

• QA. Each view has different complications with this security restriction. Most often it'll be inline style or scripts.
• Authorize some JavaScript libraries (most notably google's tag manager) using a nonce.
• Others. CSP has enough of a learning curve that its not entirely certain what might come up.

It might be worth noting that Chrome seems to have a slightly less restrictive implementation of this feature then firefox.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[bleonar5]

You may be aware of this already, but here are at least three instances of inline javascript in the app:

studies/templates/studies/_image_display.html
web/templatetags/web_extras.py
studies/templates/studies/study_detail.html

[okaycj]

You may be aware of this already, but here are at least three instances of inline javascript in the app:

studies/templates/studies/_image_display.html web/templatetags/web_extras.py studies/templates/studies/study_detail.html

Yup! I was aware of at least one of these, but need to put this down to start working on other things.