# Static asset headers (Cloudflare Workers static assets).
# The asset service answers /assets/* and /source/* without the Worker (see wrangler.toml
# run_worker_first), so the Worker cannot add its security headers to them. Add them here.
# The Content-Security-Policy is the same string as the Worker HTML responses (src/worker/http.ts).
# These files are scripts, maps and archives. None is an HTML page.

/assets/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000
  Permissions-Policy: camera=(), microphone=(), geolocation=()
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'
  Cross-Origin-Resource-Policy: same-origin

/source/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000
  Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
