Python3.11 GAE配置Flask-Talisman：CDN脚本与Cron任务问题

问题1：CDN加载ApexCharts时CSP style-src指令报错 #

问题描述 #

集成Flask-Talisman后，通过CDN加载ApexCharts时浏览器触发CSP的style-src指令错误，原因是CSP配置未正确包含Nonce占位符，且存在语法错误导致Talisman无法自动注入Nonce到style-src规则中。

错误代码 #

main.py（存在语法错误和CSP配置缺失）：

app = Flask(__name__, static_folder='media')
csp = {
    'script-src': "'self' ajax.googleapis.com *.googleanalytics.com "
                  '*.google-analytics.com '
                  '*.googletagmanager.com '
                  'https://cdn.jsdelivr.net/npm/apexcharts',
    'style-src': "'self' "
                'https://cdn.jsdelivr.net/npm/apexcharts',
    'object-src': "'none'",
    'default-src': "'self' ",
    'connect-src': "'self' *.google-analytics.com appengine.googleapis.com",
}
# 缺少闭合单引号，且CSP未包含Nonce占位符
_talisman = Talisman(app, content_security_policy=csp, content_security_policy_nonce_in=['script-src', 'style-src])

@app.get(r'/')
def main():
    ...
    context['nonce'] = _talisman._get_nonce()
    return render_template('list.html', context)

index.html：

<script nonce="{{ nonce }}" src="https://cdn.jsdelivr.net/npm/apexcharts"></script>
<script nonce="{{ nonce }}" type="text/javascript">
var options = {
    series: _series,
    chart: {
        ...
    }
}
</script>

解决方案 #

1. 修正content_security_policy_nonce_in的语法错误，补上闭合单引号；
2. 在CSP的script-src和style-src中添加'nonce-%(nonce)s'占位符，Talisman会自动将其替换为实际生成的Nonce值；

修正后的main.py：

app = Flask(__name__, static_folder='media')
csp = {
    'script-src': "'self' 'nonce-%(nonce)s' ajax.googleapis.com *.googleanalytics.com "
                  "*.google-analytics.com "
                  "*.googletagmanager.com "
                  "https://cdn.jsdelivr.net/npm/apexcharts",
    'style-src': "'self' 'nonce-%(nonce)s' https://cdn.jsdelivr.net/npm/apexcharts",
    'object-src': "'none'",
    'default-src': "'self' ",
    'connect-src': "'self' *.google-analytics.com appengine.googleapis.com",
}
# 修正语法错误，添加正确的Nonce占位符后，Talisman会自动处理Nonce注入
_talisman = Talisman(app, content_security_policy=csp, content_security_policy_nonce_in=['script-src', 'style-src'])

@app.get(r'/')
def main():
    ...
    context['nonce'] = _talisman._get_nonce()
    return render_template('list.html', context)

问题2：启用Flask-Talisman后Cron任务无法触发 #

问题描述 #

Google App Engine的Cron任务调用指定路由时无响应，日志无报错，确认是Flask-Talisman的安全策略（如强制HTTPS、CSP）拦截了内部Cron请求。

相关代码 #

cron.yaml：

- description: "daily 25:20:25"
  url: /tasks/job/25/20/25
  schedule: every day 07:30
  timezone: America/New_York

tasks.py：

from flask import Blueprint
tasks_api = Blueprint('tasks', __name__)

@tasks_api.route(r'/job/<chunks>/<start>/<end>')
def get_job(chunks=25, start=0, end=5):
    pass

解决方案 #

通过自定义Talisman策略，识别Cron任务的专属请求头（X-Appengine-Cron: true），为这类内部请求禁用强制HTTPS和CSP：

main.py中添加策略函数：

def talisman_custom_policy(app, request):
    # 识别App Engine Cron任务的请求头
    if request.headers.get('X-Appengine-Cron'):
        return {
            'force_https': False,
            'content_security_policy': None
        }
    # 其他请求使用默认策略
    return {}

# 初始化Talisman时传入自定义策略
_talisman = Talisman(
    app, 
    content_security_policy=csp, 
    content_security_policy_nonce_in=['script-src', 'style-src'],
    policy=talisman_custom_policy
)

或者直接为Cron路由单独禁用Talisman策略：
tasks.py：

from flask import Blueprint
from flask_talisman import talisman

tasks_api = Blueprint('tasks', __name__)

@tasks_api.route(r'/job/<chunks>/<start>/<end>')
@talisman(force_https=False, content_security_policy=None)
def get_job(chunks=25, start=0, end=5):
    pass

内容的提问来源于stack exchange，提问作者dugloon