From d485c2ceba07788741534c53cf0a7a8589e8ef29 Mon Sep 17 00:00:00 2001
From: Patrick Rauscher <prauscher@prauscher.de>
Date: Fri, 12 Jun 2026 13:43:33 +0200
Subject: [PATCH 1/3] do not use style-tags to prevent csp of unsafe-inline

---
 session_security/static/session_security/style.css      | 2 +-
 session_security/templates/session_security/all.html    | 2 +-
 session_security/templates/session_security/dialog.html | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/session_security/static/session_security/style.css b/session_security/static/session_security/style.css
index 89c965d..c07772a 100644
--- a/session_security/static/session_security/style.css
+++ b/session_security/static/session_security/style.css
@@ -25,6 +25,6 @@
     text-align: center;
 }
 
-.session_security {
+.session_security_hidden {
     display: none;
 }
diff --git a/session_security/templates/session_security/all.html b/session_security/templates/session_security/all.html
index a6e57c7..0fd745c 100644
--- a/session_security/templates/session_security/all.html
+++ b/session_security/templates/session_security/all.html
@@ -40,7 +40,7 @@
     {# Hidden POST form for logout — required by Django 5.x (LogoutView no longer accepts GET) #}
     {% with redirect_to_logout=request|redirect_to_logout %}
     {% if redirect_to_logout %}
-    <form id="session_security_logout_form" action="{% url 'logout' %}" method="post" style="display:none">
+    <form id="session_security_logout_form" action="{% url 'logout' %}" method="post" class="session_security_hidden">
         {% csrf_token %}
     </form>
     {% endif %}
diff --git a/session_security/templates/session_security/dialog.html b/session_security/templates/session_security/dialog.html
index 0763af5..e2d1e52 100644
--- a/session_security/templates/session_security/dialog.html
+++ b/session_security/templates/session_security/dialog.html
@@ -1,6 +1,6 @@
 {% load i18n %}
 
-<div id="session_security_warning" class="session_security" aria-hidden="true" role="dialog">
+<div id="session_security_warning" class="session_security_hidden" aria-hidden="true" role="dialog">
     <div class="session_security_overlay"></div>
     <div class="session_security_modal" role="document" tabindex="-1">
         <h3>{% trans 'Your session is about to expire' %}: <span id="session_security_counter"></span> {% trans 'seconds' %}</h3>

From 5c4cb69cd5b8e68e658b7fd0cd91a802ccac5cd4 Mon Sep 17 00:00:00 2001
From: Patrick Rauscher <prauscher@prauscher.de>
Date: Fri, 12 Jun 2026 14:35:18 +0200
Subject: [PATCH 2/3] add support for django-included csp which replaced
 django-csp

---
 session_security/templates/session_security/all.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/session_security/templates/session_security/all.html b/session_security/templates/session_security/all.html
index 0fd745c..a3868e0 100644
--- a/session_security/templates/session_security/all.html
+++ b/session_security/templates/session_security/all.html
@@ -25,7 +25,7 @@
     {# Bootstrap a SessionSecurity instance as the sessionSecurity global variable #}
     {% with redirect_to_logout_flag=request|redirect_to_logout %}
     {% localize off %}
-        <script type="text/javascript"{% if request.csp_nonce %} nonce="{{ request.csp_nonce }}"{% endif %}>
+        <script type="text/javascript"{% if csp_nonce is not None %} nonce="{{ csp_nonce }}"{% elif request.csp_nonce %} nonce="{{ request.csp_nonce }}"{% endif %}>
             var sessionSecurity = new yourlabs.SessionSecurity({
                 pingUrl: '{% url 'session_security_ping' %}',
                 warnAfter: {{ request|warn_after|unlocalize }},

From cdf739e9eae0580f455bdef50682729a42a8d00e Mon Sep 17 00:00:00 2001
From: Patrick Rauscher <prauscher@prauscher.de>
Date: Fri, 12 Jun 2026 14:51:35 +0200
Subject: [PATCH 3/3] use django-csp nonce if provided, default to djangos
 built-in nonce

note that for django<6 csp_nonce will be an empty string
---
 session_security/templates/session_security/all.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/session_security/templates/session_security/all.html b/session_security/templates/session_security/all.html
index a3868e0..e93f3c9 100644
--- a/session_security/templates/session_security/all.html
+++ b/session_security/templates/session_security/all.html
@@ -25,7 +25,7 @@
     {# Bootstrap a SessionSecurity instance as the sessionSecurity global variable #}
     {% with redirect_to_logout_flag=request|redirect_to_logout %}
     {% localize off %}
-        <script type="text/javascript"{% if csp_nonce is not None %} nonce="{{ csp_nonce }}"{% elif request.csp_nonce %} nonce="{{ request.csp_nonce }}"{% endif %}>
+        <script type="text/javascript" nonce="{% if request.csp_nonce %}{{ request.csp_nonce }}{% else %}{{ csp_nonce }}{% endif %}">
             var sessionSecurity = new yourlabs.SessionSecurity({
                 pingUrl: '{% url 'session_security_ping' %}',
                 warnAfter: {{ request|warn_after|unlocalize }},