netlify.toml

[[plugins]]
  # Setting the plugin manually, so we can pick the version (see package.json).
  package = "@netlify/plugin-nextjs"

# IMPORTANT: Keep this in sync with next.config.js
[[headers]]
  for = "/*"
  [headers.values]
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    X-Content-Type-Options = "nosniff"
    Content-Security-Policy = """
upgrade-insecure-requests; \
frame-ancestors 'self' ; \
frame-src https: ; \
connect-src \
  'self' \
  https://*.streamlit.app/ \
  wss://*.streamlit.app/ \
  https://streamlit.ghost.io/ghost/api/ \
  https://api.segment.io/ \
  https://cdn.segment.com/ \
  https://*.auryc.com/ \
  https://www.google-analytics.com/ \
  https://stats.g.doubleclick.net/ \
  https://px.ads.linkedin.com/ \
  https://*.algolia.net/ \
  https://*.algolianet.com/ \
; \
default-src 'none' ; \
font-src 'self' ; \
form-action 'self' ; \
img-src \
  'self' \
  data: \
  https: \
; \
media-src \
  'self'
  https://s3-us-west-2.amazonaws.com/assets.streamlit.io/ \
; \
script-src \
  'self' \
  'unsafe-inline' \
  'unsafe-eval' \
  https://cdn.heapanalytics.com/ \
  https://cdn.segment.com/ \
  https://www.google-analytics.com/ \
  https://www.googletagmanager.com/ \
  https://identity.netlify.com/ \
  https://netlify-cdp-loader.netlify.app/netlify.js \
  https://www.youtube.com/iframe_api/ \
  https://snap.licdn.com/ \
  https://connect.facebook.net/ \
  https://*.algolia.net/ \
  https://*.algolianet.com/ \
; \
style-src \
  'self' \
  'unsafe-inline' \
; \
worker-src \
  'self' \
  blob: \
;"""