diff options
| -rw-r--r-- | netlify.toml | 35 |
1 files changed, 30 insertions, 5 deletions
diff --git a/netlify.toml b/netlify.toml index 7083039..afa9e75 100644 --- a/netlify.toml +++ b/netlify.toml @@ -18,7 +18,7 @@ # here but we recommend using the Netlify UI for sensitive # values to keep them out of your source repository. [context.production] - command = 'hugo --enableGitInfo --source=exampleSite --destination ../public' + command = 'hugo --source=exampleSite --destination ../public' [context.production.environment] HUGO_ENV = 'production' @@ -27,7 +27,7 @@ # Deploy Preview context: all deploys generated from # a pull/merge request will inherit these settings. [context.deploy-preview] - command = 'hugo --enableGitInfo --source=exampleSite --buildDrafts --buildFuture --baseURL ${DEPLOY_PRIME_URL} --destination ../public' + command = 'hugo --source=exampleSite --buildDrafts --buildFuture --baseURL ${DEPLOY_PRIME_URL} --destination ../public' [context.deploy-preview.environment] HUGO_ENV = 'development' @@ -36,7 +36,7 @@ # a pull/merge request or from the Production branch # will inherit these settings. [context.branch-deploy] - command = 'hugo --enableGitInfo --source=exampleSite --buildDrafts --buildFuture --baseURL ${DEPLOY_PRIME_URL} --destination ../public' + command = 'hugo --source=exampleSite --buildDrafts --buildFuture --baseURL ${DEPLOY_PRIME_URL} --destination ../public' [context.branch-deploy.environment] HUGO_ENV = 'development' @@ -71,14 +71,39 @@ Strict-Transport-Security = 'max-age=31536000; includeSubDomains; preload' # This used to be called Feature Policy and is mainly only support by # Chrome browsers. It’s used to control what browser APIs can be used. - Permissions-Policy = 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()' + Permissions-Policy = ''' + accelerometer=(), + camera=(), + geolocation=(), + gyroscope=(), + magnetometer=(), + microphone=(), + payment=(), + usb=(), + interest-cohort=()''' # CSP makes it possible for server administrators to reduce or eliminate # the vectors by which XSS can occur by specifying the domains that the # browser should consider to be valid sources of executable scripts. # A CSP compatible browser will then only execute scripts loaded in source # files received from those allowed domains, ignoring all other scripts # (including inline scripts and event-handling HTML attributes). - Content-Security-Policy = "default-src 'self'; script-src 'self' *.netlify.app *.netlify.com *.googletagmanager.com; style-src 'self'; img-src 'self' data: *.google-analytics.com *.googletagmanager.com *.gstatic.com; font-src 'self'; connect-src 'self' *.google-analytics.com analytics.google.com *.googletagmanager.com *.doubleclick.net; media-src 'self'; object-src 'self'; frame-src 'none'; worker-src 'self'; frame-ancestors 'none'; form-action 'self' submit-form.com; upgrade-insecure-requests; base-uri 'self'; manifest-src 'self'; report-uri https://egrep.report-uri.com/r/d/csp/enforce" + Content-Security-Policy = """ + default-src 'self'; + script-src 'self' *.netlify.app *.netlify.com *.googletagmanager.com; + style-src 'self'; + img-src 'self' data: *.google-analytics.com *.googletagmanager.com *.gstatic.com; + font-src 'self'; + connect-src 'self' *.google-analytics.com *.analytics.google.com analytics.google.com *.googletagmanager.com *.doubleclick.net; + media-src 'self'; + object-src 'self'; + frame-src 'none'; + worker-src 'self'; + frame-ancestors 'none'; + form-action 'self' submit-form.com; + upgrade-insecure-requests; + base-uri 'self'; + manifest-src 'self'; + report-uri https://egrep.report-uri.com/r/d/csp/enforce""" [[headers]] for = '/feeds/*.xml' |