From 2a43caab34f5bd130f96c15d4ad352d24213b5ad Mon Sep 17 00:00:00 2001 From: Jacob Coffee Date: Fri, 9 Oct 2026 09:21:14 -0500 Subject: [PATCH] fix(csp): drop jQuery prefetch hints, allow console.python.org frames The prefetch s for jQuery/jQuery UI are governed by default-src ('self' only), producing ~75k report-only violations/day in Sentry (PYDOTORG-PROD-1NX). Both scripts already load synchronously at the end of base.html, so the hints only caused a duplicate fetch. The homepage interactive shell iframes https://console.python.org, which fell back to default-src with no frame-src set (PYDOTORG-PROD-1PS). --- pydotorg/settings/base.py | 5 +++++ templates/base.html | 3 --- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/pydotorg/settings/base.py b/pydotorg/settings/base.py index a9403580f..558dfe469 100644 --- a/pydotorg/settings/base.py +++ b/pydotorg/settings/base.py @@ -346,6 +346,11 @@ # Status Page, host included in 'static/js/script.js' "https://2p66nmmycsj3.statuspage.io", ], + "frame-src": [ + SELF, + # Interactive shell on the homepage, see 'templates/python/shell.html' + "https://console.python.org", + ], "frame-ancestors": [SELF], "base-uri": [SELF], "object-src": ["'none'"], diff --git a/templates/base.html b/templates/base.html index 24afeb4d0..826718102 100644 --- a/templates/base.html +++ b/templates/base.html @@ -11,9 +11,6 @@ - - -