_headers

# Response headers for everything flield.com serves. Cloudflare reads this
# file at deploy time and does not serve it. Every page is static, has no
# form, and talks to nothing but its own origin, so the policy can say
# exactly that.
#
# The one exception is Cloudflare Web Analytics, which the dashboard
# injects at the edge as a script from static.cloudflareinsights.com that
# then posts to cloudflareinsights.com. Both hosts are allowed below; drop
# them if analytics is ever turned off.
#
# script-src carries 'unsafe-inline' because the app is one long inline
# script and the document pages each have one too. A nonce would need a
# server to mint it, and there is none. What the policy still buys is that
# no script from any other host runs, no page can be re-based, nothing
# embeds a plugin, and no form posts anywhere. img-src allows data: for
# the favicon the app redraws on every load and blob: for the exported
# frames; worker-src covers the vendored GIF encoder's worker.
/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; worker-src 'self' blob:; connect-src 'self' https://cloudflareinsights.com; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'

# The files index.html and the document pages request with a ?v= query.
# Their cache is busted by the number, which CI makes sure moves whenever
# the file does, so the copy a browser holds can be trusted for as long as
# a browser will keep it. Without this every asset carried Cloudflare's
# default of max-age=0, and a returning visitor revalidated the stylesheet
# and the generator on every load. Pages stay on the default: their names
# never change, so they have to be checked each time. The vendored GIF
# encoder is left out too; it carries no ?v=, so a swapped file under the
# same name would sit stale for a year.
/style.css
  Cache-Control: public, max-age=31536000, immutable
/generator.js
  Cache-Control: public, max-age=31536000, immutable
/guide.css
  Cache-Control: public, max-age=31536000, immutable
/screenshot.png
  Cache-Control: public, max-age=31536000, immutable
/screenshot.webp
  Cache-Control: public, max-age=31536000, immutable
/screenshot-800.webp
  Cache-Control: public, max-age=31536000, immutable