netlify.toml

# Configure Netlify to serve particular headers for certain routes
[[headers]]
  # Define which paths this specific [[headers]] block will cover.
  for = "/*"
    [headers.values]
      Referrer-Policy = "origin-when-cross-origin"
      X-XSS-Protection = "1; mode=block"
      X-Content-Type = "nosniff"
      # Multi-key header rules are expressed with multi-line strings.
      Content-Security-Policy = '''
      default-src 'self';
      connect-src 'self' https://p.trellocdn.com https://api.openweathermap.org;
      script-src 'self' https://p.trellocdn.com;
      style-src 'self' https://p.trellocdn.com;
      frame-ancestors https://trello.com;'''

  # enable CORS on one of our string files to enable testing
[[headers]]
  for = "/en.json"
    [headers.values]
      Access-Control-Allow-Origin = "*"