We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Send Content-Security-Policy header
The Content-Security-Policy (CSP) header (with the `frame-ancestors` directive) replaces the now deprecated `X-Frame-Options` header, to instruct the browser about appropriate actions to perform if a site is included inside an `<iframe>`.

See more at https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

We already have Django's built-in [Clickjacking/`X-Frame-Options` features enabled](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py#L52). Since this app should never be run from an `<iframe>`, let's create another Middleware that sets the CSP header like so:

```
Content-Security-Policy: default-src 'self'; frame-ancestors 'none';
```

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `benefits/settings.py`
Content:
```
1 """
2 Django settings for benefits project.
3 """
4 import os
5 
6 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
7 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
8 
9 # SECURITY WARNING: keep the secret key used in production secret!
10 SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
11 
12 # SECURITY WARNING: don't run with debug turned on in production!
13 DEBUG = os.environ.get("DJANGO_DEBUG", "False").lower() == "true"
14 
15 ADMIN = os.environ.get("DJANGO_ADMIN", "False").lower() == "true"
16 
17 ALLOWED_HOSTS = []
18 
19 if DEBUG:
20     ALLOWED_HOSTS.extend(["*"])
21 else:
22     hosts = os.environ["DJANGO_ALLOWED_HOSTS"].split(",")
23     ALLOWED_HOSTS.extend(hosts)
24 
25 # Application definition
26 
27 INSTALLED_APPS = [
28     "django.contrib.sessions",
29     "django.contrib.staticfiles",
30     "benefits.core",
31     "benefits.enrollment",
32     "benefits.eligibility",
33 ]
34 
35 if ADMIN:
36     INSTALLED_APPS.extend(
37         [
38             "django.contrib.admin",
39             "django.contrib.auth",
40             "django.contrib.contenttypes",
41             "django.contrib.messages",
42         ]
43     )
44 
45 MIDDLEWARE = [
46     "django.middleware.security.SecurityMiddleware",
47     "django.contrib.sessions.middleware.SessionMiddleware",
48     "django.middleware.locale.LocaleMiddleware",
49     "benefits.core.middleware.Healthcheck",
50     "django.middleware.common.CommonMiddleware",
51     "django.middleware.csrf.CsrfViewMiddleware",
52     "django.middleware.clickjacking.XFrameOptionsMiddleware",
53     "benefits.core.middleware.DebugSession",
54     "benefits.core.middleware.ChangedLanguageEvent",
55 ]
56 
57 if ADMIN:
58     MIDDLEWARE.extend(
59         [
60             "django.contrib.auth.middleware.AuthenticationMiddleware",
61             "django.contrib.messages.middleware.MessageMiddleware",
62         ]
63     )
64 
65 CSRF_COOKIE_AGE = None
66 CSRF_COOKIE_SAMESITE = "Strict"
67 CSRF_COOKIE_HTTPONLY = True
68 
69 SESSION_COOKIE_SAMESITE = "Strict"
70 SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
71 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
72 
73 if not DEBUG:
74     CSRF_COOKIE_SECURE = True
75     CSRF_FAILURE_VIEW = "benefits.core.views.csrf_failure"
76     SESSION_COOKIE_SECURE = True
77 
78 ROOT_URLCONF = "benefits.urls"
79 
80 template_ctx_processors = [
81     "django.template.context_processors.request",
82     "benefits.core.context_processors.analytics",
83 ]
84 
85 if DEBUG:
86     template_ctx_processors.extend(
87         [
88             "django.template.context_processors.debug",
89             "benefits.core.context_processors.debug",
90         ]
91     )
92 
93 if ADMIN:
94     template_ctx_processors.extend(
95         [
96             "django.contrib.auth.context_processors.auth",
97             "django.contrib.messages.context_processors.messages",
98         ]
99     )
100 
101 TEMPLATES = [
102     {
103         "BACKEND": "django.template.backends.django.DjangoTemplates",
104         "DIRS": [os.path.join(BASE_DIR, "benefits", "templates")],
105         "APP_DIRS": True,
106         "OPTIONS": {
107             "context_processors": template_ctx_processors,
108         },
109     },
110 ]
111 
112 WSGI_APPLICATION = "benefits.wsgi.application"
113 
114 DATABASES = {
115     "default": {
116         "ENGINE": "django.db.backends.sqlite3",
117         "NAME": os.environ.get("DJANGO_DB", "django") + ".db",
118     }
119 }
120 
121 # Password validation
122 
123 AUTH_PASSWORD_VALIDATORS = []
124 
125 if ADMIN:
126     AUTH_PASSWORD_VALIDATORS.extend(
127         [
128             {
129                 "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
130             },
131             {
132                 "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
133             },
134             {
135                 "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
136             },
137             {
138                 "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
139             },
140         ]
141     )
142 
143 # Internationalization
144 
145 LANGUAGE_CODE = "en"
146 
147 LANGUAGE_COOKIE_HTTPONLY = True
148 LANGUAGE_COOKIE_SAMESITE = "Strict"
149 LANGUAGE_COOKIE_SECURE = True
150 
151 LANGUAGES = [("en", "English"), ("es", "Español")]
152 
153 LOCALE_PATHS = [os.path.join(BASE_DIR, "benefits", "locale")]
154 
155 USE_I18N = True
156 USE_L10N = True
157 
158 TIME_ZONE = "UTC"
159 USE_TZ = True
160 
161 # Static files (CSS, JavaScript, Images)
162 
163 STATIC_URL = "/static/"
164 STATICFILES_DIRS = [os.path.join(BASE_DIR, "benefits", "static")]
165 STATIC_ROOT = os.path.join(BASE_DIR, "static")
166 
167 # Logging configuration
168 
169 LOG_LEVEL = os.environ.get("DJANGO_LOG_LEVEL", "DEBUG" if DEBUG else "WARNING")
170 LOGGING = {
171     "version": 1,
172     "disable_existing_loggers": False,
173     "formatters": {
174         "default": {
175             "format": "[{asctime}] {levelname} {name}:{lineno} {message}",
176             "datefmt": "%d/%b/%Y %H:%M:%S",
177             "style": "{",
178         },
179     },
180     "handlers": {
181         "default": {"class": "logging.StreamHandler", "formatter": "default"},
182     },
183     "root": {
184         "handlers": ["default"],
185         "level": LOG_LEVEL,
186     },
187     "loggers": {"django": {"handlers": ["default"], "propagate": False}},
188 }
189 
190 # Analytics configuration
191 
192 ANALYTICS_KEY = os.environ.get("ANALYTICS_KEY")
193
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/benefits/settings.py b/benefits/settings.py
--- a/benefits/settings.py
+++ b/benefits/settings.py
@@ -50,6 +50,7 @@
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "csp.middleware.CSPMiddleware",
     "benefits.core.middleware.DebugSession",
     "benefits.core.middleware.ChangedLanguageEvent",
 ]
@@ -188,3 +189,35 @@
 # Analytics configuration
 
 ANALYTICS_KEY = os.environ.get("ANALYTICS_KEY")
+
+# Content Security Policy
+# Configuration docs at https://django-csp.readthedocs.io/en/latest/configuration.html
+
+# In particular, note that the inner single-quotes are required!
+# https://django-csp.readthedocs.io/en/latest/configuration.html#policy-settings
+
+CSP_DEFAULT_SRC = ["'self'"]
+
+CSP_CONNECT_SRC = ["'self'", "https://api.amplitude.com/"]
+
+CSP_FONT_SRC = ["https://california.azureedge.net/cdt/statetemplate/", "https://fonts.gstatic.com/"]
+
+CSP_FRAME_ANCESTORS = ["'none'"]
+CSP_FRAME_SRC = ["'none'"]
+
+CSP_SCRIPT_SRC_ELEM = [
+    "'unsafe-inline'",
+    "https://california.azureedge.net/cdt/statetemplate/",
+    "https://cdn.amplitude.com/libs/",
+    "https://code.jquery.com/",
+    "*.littlepay.com",
+]
+
+CSP_STYLE_SRC = ["'unsafe-inline'"]
+
+CSP_STYLE_SRC_ELEM = [
+    "'self'",
+    "'unsafe-inline'",
+    "https://california.azureedge.net/cdt/statetemplate/",
+    "https://fonts.googleapis.com/css",
+]

{"golden_diff": "diff --git a/benefits/settings.py b/benefits/settings.py\n--- a/benefits/settings.py\n+++ b/benefits/settings.py\n@@ -50,6 +50,7 @@\n     \"django.middleware.common.CommonMiddleware\",\n     \"django.middleware.csrf.CsrfViewMiddleware\",\n     \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n+    \"csp.middleware.CSPMiddleware\",\n     \"benefits.core.middleware.DebugSession\",\n     \"benefits.core.middleware.ChangedLanguageEvent\",\n ]\n@@ -188,3 +189,35 @@\n # Analytics configuration\n \n ANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n+\n+# Content Security Policy\n+# Configuration docs at https://django-csp.readthedocs.io/en/latest/configuration.html\n+\n+# In particular, note that the inner single-quotes are required!\n+# https://django-csp.readthedocs.io/en/latest/configuration.html#policy-settings\n+\n+CSP_DEFAULT_SRC = [\"'self'\"]\n+\n+CSP_CONNECT_SRC = [\"'self'\", \"https://api.amplitude.com/\"]\n+\n+CSP_FONT_SRC = [\"https://california.azureedge.net/cdt/statetemplate/\", \"https://fonts.gstatic.com/\"]\n+\n+CSP_FRAME_ANCESTORS = [\"'none'\"]\n+CSP_FRAME_SRC = [\"'none'\"]\n+\n+CSP_SCRIPT_SRC_ELEM = [\n+    \"'unsafe-inline'\",\n+    \"https://california.azureedge.net/cdt/statetemplate/\",\n+    \"https://cdn.amplitude.com/libs/\",\n+    \"https://code.jquery.com/\",\n+    \"*.littlepay.com\",\n+]\n+\n+CSP_STYLE_SRC = [\"'unsafe-inline'\"]\n+\n+CSP_STYLE_SRC_ELEM = [\n+    \"'self'\",\n+    \"'unsafe-inline'\",\n+    \"https://california.azureedge.net/cdt/statetemplate/\",\n+    \"https://fonts.googleapis.com/css\",\n+]\n", "issue": "Send Content-Security-Policy header\nThe Content-Security-Policy (CSP) header (with the `frame-ancestors` directive) replaces the now deprecated `X-Frame-Options` header, to instruct the browser about appropriate actions to perform if a site is included inside an `<iframe>`.\r\n\r\nSee more at https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\r\n\r\nWe already have Django's built-in [Clickjacking/`X-Frame-Options` features enabled](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py#L52). Since this app should never be run from an `<iframe>`, let's create another Middleware that sets the CSP header like so:\r\n\r\n```\r\nContent-Security-Policy: default-src 'self'; frame-ancestors 'none';\r\n```\n", "before_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_AGE = None\nCSRF_COOKIE_SAMESITE = \"Strict\"\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGE_COOKIE_HTTPONLY = True\nLANGUAGE_COOKIE_SAMESITE = \"Strict\"\nLANGUAGE_COOKIE_SECURE = True\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n", "path": "benefits/settings.py"}], "after_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"csp.middleware.CSPMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_AGE = 3600\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGE_COOKIE_HTTPONLY = True\nLANGUAGE_COOKIE_SAMESITE = \"Strict\"\nLANGUAGE_COOKIE_SECURE = True\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n\n# Content Security Policy\n# Configuration docs at https://django-csp.readthedocs.io/en/latest/configuration.html\n\n# In particular, note that the inner single-quotes are required!\n# https://django-csp.readthedocs.io/en/latest/configuration.html#policy-settings\n\nCSP_DEFAULT_SRC = [\"'self'\"]\n\nCSP_CONNECT_SRC = [\"'self'\", \"https://api.amplitude.com/\"]\n\nCSP_FONT_SRC = [\"https://california.azureedge.net/cdt/statetemplate/\", \"https://fonts.gstatic.com/\"]\n\nCSP_FRAME_ANCESTORS = [\"'none'\"]\nCSP_FRAME_SRC = [\"'none'\"]\n\nCSP_SCRIPT_SRC_ELEM = [\n    \"'unsafe-inline'\",\n    \"https://california.azureedge.net/cdt/statetemplate/\",\n    \"https://cdn.amplitude.com/libs/\",\n    \"https://code.jquery.com/\",\n    \"*.littlepay.com\",\n]\n\nCSP_STYLE_SRC = [\"'unsafe-inline'\"]\n\nCSP_STYLE_SRC_ELEM = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    \"https://california.azureedge.net/cdt/statetemplate/\",\n    \"https://fonts.googleapis.com/css\",\n]\n", "path": "benefits/settings.py"}]}