CORS for netlify

_header

/*
  Access-Control-Allow-Origin: *
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  Content-Security-Policy: default-src 'self';script-src  https://gc.zgo.at;;default-src 'self';font-src fonts.gstatic.com;style-src 'self' fonts.googleapis.com;frame-ancestors 'self';

https://www.jakobwillforss.com/post/content-security-policy-for-font-awesome-on-netlify/

https://docs.netlify.com/routing/headers/?_ga=2.28600444.1726432171.1631626554-867901973.1604137354
https://play.netlify.com/headers
https://content-security-policy.com/

https://dev.to/mannuelf/content-security-policy-on-netlify-guide-4p0c
https://github.com/mannuelf/mannuelferreira.com_nextjs/blob/main/netlify.toml#L15

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'report-sample' 'self' https://d33wubrfki0l68.cloudfront.net/js/ff8ac4c81ce5ed14cd31613de03e5f88b2246884/js/freeshipping.min.js https://gc.zgo.at/count.js; style-src 'report-sample' 'self' https://d33wubrfki0l68.cloudfront.net https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self'; font-src 'self' https://d33wubrfki0l68.cloudfront.net https://fonts.gstatic.com; frame-src 'self'; img-src 'self'; manifest-src 'self'; media-src 'self'; report-uri https://614321f56985df6b7167f5c0.endpoint.csper.io/; worker-src 'none';

Content-Security-Policy: default-src 'self';script-src https://gc.zgo.at;img-src https://aviparshan.goatcounter.com/count;default-src 'self';font-src fonts.gstatic.com;style-src 'self' fonts.googleapis.com;frame-ancestors 'self';