inline styles and CSP

[millerthegorilla]

Hi, I am returning to web development after a break, and am wondering what the correct thing to do is about the amount of inline styles that are used by Django Jazzmin or its dependencies. I don't want to use unsafe-inline if at all possible, but no matter how many times I add hashes, they change dynamically based on the cache buster strings or other variables, and so the checksums seem to change with them.

Can you make a recommendation? Is there a point that Django Jazzmin will stop using inline styles in terms of its development?

MTIA

[Njeru58]

Hi!

It is quite right of you to worry about unsafe-inline in your Content Security Policy; it is an actual security issue, and indeed, Django Jazzmin (and portions of some of its dependencies) does use inline styles and inline scripts, particularly in core templates in the administration.

---

Two Methods You might Like to Pursue:

1. Make a Personal Admin Page / Dashboard

An unruffled workaround is, instead of confronting directly the inline behavior of Jazzmin:
Make your own CustomAdminSite class

• Considering the use of a custom dashboard layout (base_site.html, index.html, etc.)
• Make use of external .css and .js files where you have full control of the styling- avoid inline all-together
  Designate your own administration site or apps, but leave everything not there in the default

Like this you avoid the majority of the inline styling and take full control over your CSP. It also is more long-term scalable to a more specific UX when you desire so.

You can use this page on Django docs on customizing the administration sites to get started.

---

2. Inline Styles (Want to contribute?):Source Code refactor

In case you are willing to invest some, it would also help:
Determine the use of inline styles by Jazzmin
Put them into fixed files (e.g. custom.css)
Make a PR to assist the project in the direction of CSP friendly templates

I would gladly be a part of this, it would be a beneficial long-term change to all users of Jazzmin.

---

Would like to hear what the maintainers think is the opinion of this sort of refactor effort being supported by them. In any case, you have good choices in terms of how far you wish to research.

Thanks once more on raising this.

[millerthegorilla]

Hey, thanks for getting back to me. I would actually be happy to devote some time to a new branch and a pull request to refactor inline styles. I will try and set aside some time this week to take a better look, before I absolutely commit, but I should be able to find the time. Cheers for now! James James Stewart Miller Bsc(hons) Psych.

…

On Mon, 14 Jul 2025, 12:50 Rayo_Noxx, ***@***.***> wrote: *Njeru58* left a comment (farridav/django-jazzmin#641) <#641 (comment)> Hi! It is quite right of you to worry about unsafe-inline in your Content Security Policy; it is an actual security issue, and indeed, Django Jazzmin (and portions of some of its dependencies) does use inline styles and inline scripts, particularly in core templates in the administration. ------------------------------ Two Methods You might Like to Pursue: 1. Make a Personal Admin Page / Dashboard An unruffled workaround is, instead of confronting directly the inline behavior of Jazzmin: Make your own CustomAdminSite class - Considering the use of a custom dashboard layout (base_site.html, index.html, etc.) - Make use of external .css and .js files where you have full control of the styling- avoid inline all-together Designate your own administration site or apps, but leave everything not there in the default Like this you avoid the majority of the inline styling and take full control over your CSP. It also is more long-term scalable to a more specific UX when you desire so. You can use this page on Django docs on customizing the administration sites <https://docs.djangoproject.com/en/stable/ref/contrib/admin/#adminsite-objects> to get started. ------------------------------ 2. *Inline Styles (Want to contribute?)*:Source Code refactor In case you are willing to invest some, it would also help: Determine the use of inline styles by Jazzmin Put them into fixed files (e.g. custom.css) Make a PR to assist the project in the direction of CSP friendly templates I would gladly be a part of this, it would be a beneficial long-term change to all users of Jazzmin. ------------------------------ Would like to hear what the maintainers think is the opinion of this sort of refactor effort being supported by them. In any case, you have good choices in terms of how far you wish to research. Thanks once more on raising this. — Reply to this email directly, view it on GitHub <#641 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4GSGNN7DUTLJH73YXQY5D3IOKPRAVCNFSM6AAAAACBJ4SZGCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTANRZGE4TCOBQG4> . You are receiving this because you authored the thread.Message ID: ***@***.***>