netlify.toml

[[redirects]]
  from = "/*"
  to = "/index.html"
  status = 200

[[headers]]
  for = "/*"
  [headers.values]
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    X-Frame-Options = "SAMEORIGIN"
    X-Content-Type-Options = "nosniff"
    Access-Control-Allow-Origin = "*"
    Content-Security-Policy = '''
      default-src 'self';
      object-src 'none';
      script-src 'self' https://*.cloudflareinsights.com https://hcaptcha.com https://bszhueyhgsdxrzchvdqd.supabase.co;
      img-src 'self' blob: https://bszhueyhgsdxrzchvdqd.supabase.co;
      child-src 'self' https://*.hcaptcha.com https://bszhueyhgsdxrzchvdqd.supabase.co;
      connect-src 'self' https://cloudflareinsights.com https://*.hcaptcha.com https://bszhueyhgsdxrzchvdqd.supabase.co;
      script-src-elem 'self' https://*.cloudflareinsights.com https://hcaptcha.com https://bszhueyhgsdxrzchvdqd.supabase.co;
      frame-ancestors 'none';
      upgrade-insecure-requests;
      block-all-mixed-content;
    '''
    X-Permitted-Cross-Domain-Policies = "none"
    Referrer-Policy = "no-referrer"
    #Cross-Origin-Embedder-Policy = "credentialless"
    #Cross-Origin-Opener-Policy = "same-origin"
    #Cross-Origin-Resource-Policy = "cross-origin"
    Permissions-Policy = '''
      accelerometer=(),
      autoplay=(self),
      camera=(self),
      cross-origin-isolated=(self),
      display-capture=(),
      document-domain=(),
      encrypted-media=(),
      fullscreen=(self),
      geolocation=(self),
      gyroscope=(self),
      magnetometer=(),
      microphone=(),
      midi=(),
      payment=(),
      picture-in-picture=(),
      usb=()
    '''
    # Unrecognized features:
    # Permissions-Policy = '''
    #   ambient-light-sensor=(),
    #   battery=(self),
    #   execution-while-not-rendered=(self),
    #   execution-while-out-of-viewport=(self),
    #   keyboard-map=(),
    #   navigation-override=(self),
    # '''

[[headers]]
  for = "/auth/logout"
  [headers.values]
    Clear-Site-Data = "'cookies'"

[[headers]]
  for = "https://cloudflareinsights.com"
  [headers.values]
    Access-Control-Allow-Origin = "*"

[[headers]]
  for = "*"
  [headers.values]
    Access-Control-Allow-Origin = "*"