customHttp.yml

# This file is used to set up headers and a content security policy for your app if you are hosting it via AWS Amplify.
# A valid content security policy is required for a view to be hosted inside a production MyDataHelps project: https://developer.mydatahelps.org/views/review.html
# If you are not hosting your app using AWS amplify, this file can be deleted.
customHeaders:
  - pattern: '**/*'
    headers:
      - key: 'Strict-Transport-Security'
        value: 'max-age=31536000; includeSubDomains'
      - key: 'X-XSS-Protection'
        value: '1; mode=block'
      - key: 'X-Content-Type-Options'
        value: 'nosniff'
      - key: 'Access-Control-Allow-Origin'
        value: '*'
      - key: 'Access-Control-Allow-Methods'
        value: 'GET, HEAD, OPTIONS'
      - key: "Cross-Origin-Opener-Policy"
        value: "same-origin-allow-popups"
      - key: 'Content-Security-Policy'
        value: "default-src 'self'; 
                script-src 'self'; 
                object-src 'self'; 
                style-src 'self' 'unsafe-inline';
                img-src 'self' data: mydatahelps.org rkstudio.careevolution.com http://localhost:*; 
                media-src 'self'; 
                frame-src 'self'; 
                font-src 'self'; 
                connect-src 'self' http://localhost:* mydatahelps.org rkstudio.careevolution.com;"