statedoku/_headers at main · sbbb-git/statedoku · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Cloudflare Pages: custom response headers
# Docs: https://developers.cloudflare.com/pages/configuration/headers/
#
# One global rule, no per-path CSP overrides. The /play/* pages need a
# permissive frame-ancestors so third-party sites can iframe the games, but
# that is handled entirely in functions/_middleware.js, which rewrites the
# header per request. Setting it here as well made Cloudflare emit two CSP
# headers comma-joined, and browsers then enforce the strictest
# frame-ancestors of the two, which broke embedding.

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com https://analytics.ahrefs.com https://www.clarity.ms https://*.clarity.ms https://www.googletagmanager.com https://pagead2.googlesyndication.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://statedoku.com https://*.clarity.ms; connect-src 'self' https://cloudflareinsights.com https://analytics.ahrefs.com https://*.clarity.ms; frame-ancestors 'self'; base-uri 'self'; form-action 'self'

# ─────────────────────────────────────────────────────────────
# Caching strategy:
#   - HTML & JS & CSS & JSON: ALWAYS revalidate (no stale code).
#     Cloudflare's edge serves a 304 Not Modified when nothing
#     changed, so it stays fast — but you never see old code
#     after a deploy. No more hard-refreshes needed.
#   - Images / icons / fonts: long cache (they rarely change,
#     and when they do we bust them with ?v=N).
# ─────────────────────────────────────────────────────────────

/*.html
  Cache-Control: public, no-cache, must-revalidate
/
  Cache-Control: public, no-cache, must-revalidate

/js/*
  Cache-Control: public, no-cache, must-revalidate
/css/*
  Cache-Control: public, no-cache, must-revalidate
/data/*
  Cache-Control: public, no-cache, must-revalidate
/config.js
  Cache-Control: public, no-cache, must-revalidate
/sw.js
  Cache-Control: public, no-cache, must-revalidate
/manifest.json
  Cache-Control: public, no-cache, must-revalidate

# llms.txt / llms-full.txt — served as text/plain so LLMs and curl clients
# treat them as plain text (the .txt extension defaults to octet-stream on
# some Cloudflare edges). Always revalidate so updates propagate.
/llms.txt
  Content-Type: text/plain; charset=utf-8
  Cache-Control: public, no-cache, must-revalidate
  Access-Control-Allow-Origin: *
/llms-full.txt
  Content-Type: text/plain; charset=utf-8
  Cache-Control: public, no-cache, must-revalidate
  Access-Control-Allow-Origin: *

# Long cache for static binaries (they rarely change; cache-bust with ?v=N)
/favicon.svg
  Cache-Control: public, max-age=2592000
/favicon-*.png
  Cache-Control: public, max-age=2592000
/apple-touch-icon.png
  Cache-Control: public, max-age=2592000
/og-image.*
  Cache-Control: public, max-age=2592000
/*.woff2
  Cache-Control: public, max-age=31536000, immutable

# NOTE: /play/* CSP is deliberately NOT set here. functions/_middleware.js
# rewrites it per request so third-party sites can iframe the games. Setting
# it in both places made Cloudflare emit the policy twice, comma-joined, and
# browsers then enforce the strictest frame-ancestors of the two.