Files
hinode/config/_default/server.toml
Mark Dumay 6be688515d Adjust CSP
2024-05-25 19:10:00 +02:00

42 lines
1.6 KiB
TOML

# toml-docs-start server-config
[[headers]]
for = '/**'
[headers.values]
Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options = "nosniff"
X-XSS-Protection = "1; mode=block"
Content-Security-Policy = """\
default-src 'self'; \
script-src 'self' https://*.google-analytics.com https://*.googletagmanager.com; \
style-src 'self' https://fonts.googleapis.com https://www.youtube.com; \
object-src 'none'; \
base-uri 'self'; \
connect-src 'self'
https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com; \
font-src 'self' https://fonts.gstatic.com; \
frame-src 'self' https://www.youtube-nocookie.com https://www.youtube.com; \
img-src 'self' data: https://*.imgix.net https://*.imagekit.io https://*.cloudinary.com https://i.vimeocdn.com https://i.ytimg.com https://*.google-analytics.com https://*.googletagmanager.com https://tile.openstreetmap.org; \
manifest-src 'self'; \
media-src 'self' \
"""
X-Frame-Options = "SAMEORIGIN"
Referrer-Policy = "strict-origin"
Permissions-Policy = """\
geolocation=(), \
midi=(), \
sync-xhr=(), \
microphone=(), \
camera=(), \
magnetometer=(), \
gyroscope=(), \
fullscreen=(), \
payment=() \
"""
cache-control = """\
max-age=0, \
no-cache, \
no-store, \
must-revalidate \
"""
Access-Control-Allow-Origin = "*"
# toml-docs-end server-config