netlify.toml

[build]
  command = "yarn build"
  publish = "dist"
  functions = "lambda"


# created in part using CSP Generator extension (csper.io)
# hash obtained by console error or using https://report-uri.com/home/hash, delete only the <script></script> tags, keeping whitespace
[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = '''
      default-src 'self';
      script-src 'self' 'sha256-dK06Ziaa0EW7eznMaLyuarFhVcusz+7eBUuwXo3gWD8=' https://js.stripe.com/v3 https://js.stripe.com/v3/ https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com/gtag/js;
      style-src 'self';
      object-src 'none';
      base-uri 'self';
      connect-src 'self' https://api.pushshift.io https://elastic.pushshift.io https://oauth.reddit.com https://ored.reveddit.com https://cred2.reveddit.com https://api.reveddit.com https://www.reddit.com https://removeddit.com https://www.google-analytics.com https://region1.google-analytics.com https://region1.analytics.google.com;
      font-src 'self';
      frame-src 'self' https://js.stripe.com https://youtube.com https://www.youtube.com https://www.youtube-nocookie.com/;
      img-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://region1.analytics.google.com data: https:;
      manifest-src 'self';
      media-src 'self';
      worker-src 'self';
    '''
    X-Content-Type-Options = "nosniff"
    X-Frame-Options = "DENY"
    X-XSS-Protection = "1; mode=block"

[[headers]]
  for = "/images/*"

  [headers.values]
    cache-control = '''
    public,
    max-age=31536000'''

[[headers]]
  for = "/*.js"

  [headers.values]
    cache-control = '''
    public,
    max-age=31536000'''

[[headers]]
  for = "/*.css"

  [headers.values]
    cache-control = '''
    public,
    max-age=31536000'''

[[headers]]
  for = "/service-worker.js"
  [headers.values]
    cache-control = '''
    max-age=0,
    no-cache,
    no-store,
    must-revalidate
    '''