update csp and cache-control

Signed-off-by: Rui Chen <[email protected]>
runatlantis · May 8, 2024 · e5b59b9 · e5b59b9
1 parent 88391da
commit e5b59b9
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/netlify.toml b/netlify.toml
@@ -21,9 +21,11 @@
   [headers.values]
     X-Frame-Options = "DENY"
     X-XSS-Protection = "1; mode=block"
-    Content-Security-Policy = "default-src 'self'"
-    Cache-Control = "public, max-age=0, must-revalidate"
-    Strict-Transport-Security = "max-age=31536000"
+    Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:"
+    Cache-Control = "public, max-age=86400, must-revalidate"
+    Strict-Transport-Security = "max-age=86400; includeSubDomains; preload"
+    Referrer-Policy = "no-referrer"
+    X-Content-Type-Options = "nosniff"
 
 [[headers]]
   for = "*.html"