How to identify all document requests in _headers for Cloudflare Pages?

I’m using the _headers file in my Cloudflare Pages project (live here) to add headers to some requests.

I would like to add some of these headers (Content Security Policy for example) only to document requests. Unfortunately, I didn’t find how to set this header only once for all documents.

I only managed to set the header with 2 separate rules matching both / and /*/, which means all my document related headers have to be defined twice.

If I try to use */, I get this error in the build logs:

Found invalid header lines:
  - #46:  */
    Expected a colon-separated header pair (e.g. name: value)

Is there a better way?

Can you please post the full “_header” file here?
Also please make sure that it follows the instructions here: https://developers.cloudflare.com/pages/platform/headers where you, after defining the path/URL need to define the name of the header and then the value of the header.

Anyway, I appreciate you shooting with a Fujifilm X-T2. I personally shoot with SONY, but since these two manufacturers are very “similar” I like what I see.

The error was when I had */, I now removed it.

The full _headers file is there: nicolas-hoizey.photo/_headers at main · nhoizey/nicolas-hoizey.photo · GitHub

The relevant part with duplication is this one:

/
  Cache-Control: public, max-age=14405
  Link: </ui/fonts/Coniferous-Regular-subset.woff2>;rel=preload;as=font;crossorigin;nopush
  Link: <https://res.cloudinary.com>;rel="preconnect"
  Content-Security-Policy: upgrade-insecure-requests;base-uri 'self';script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data.nicolas-hoizey.com https://static.cloudflareinsights.com;img-src 'self' nicolas-hoizey.photo data.nicolas-hoizey.com res.cloudinary.com api.mapbox.com blob: data:;object-src 'self';connect-src 'self' data.nicolas-hoizey.com res.cloudinary.com https://*.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com https://cloudflareinsights.com;worker-src blob:;child-src blob:;frame-ancestors 'none';report-uri https://nhocom.report-uri.com/r/d/csp/enforce
  Feature-Policy: accelerometer 'none';camera 'none';geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';payment 'none';usb 'none'
  Permissions-Policy: accelerometer=(),camera=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),payment=(),usb=()
  Origin-Trial: An/QZmBh2+kGG0v/E+L7X5JZ1K8WW+IbzKGTJSa0fCKkkl6tqqH5Jjfh/+aG7YpANvKA6xcSqFC9a2SpUNG3IAkAAABeeyJvcmlnaW4iOiJodHRwczovL25pY29sYXMtaG9pemV5LnBob3RvOjQ0MyIsImZlYXR1cmUiOiJQcmlvcml0eUhpbnRzQVBJIiwiZXhwaXJ5IjoxNjQ3OTkzNTk5fQ==
  Accept-CH: Downlink,RTT,Device-Memory,Save-Data,DPR,Width

/*/
  Cache-Control: public, max-age=14406
  Link: </ui/fonts/Coniferous-Regular-subset.woff2>;rel=preload;as=font;crossorigin;nopush
  Link: <https://res.cloudinary.com>;rel="preconnect"
  Content-Security-Policy: upgrade-insecure-requests;base-uri 'self';script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data.nicolas-hoizey.com https://static.cloudflareinsights.com;img-src 'self' nicolas-hoizey.photo data.nicolas-hoizey.com res.cloudinary.com api.mapbox.com blob: data:;object-src 'self';connect-src 'self' data.nicolas-hoizey.com res.cloudinary.com https://*.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com https://cloudflareinsights.com;worker-src blob:;child-src blob:;frame-ancestors 'none';report-uri https://nhocom.report-uri.com/r/d/csp/enforce
  Feature-Policy: accelerometer 'none';camera 'none';geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';payment 'none';usb 'none'
  Permissions-Policy: accelerometer=(),camera=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),payment=(),usb=()
  Origin-Trial: An/QZmBh2+kGG0v/E+L7X5JZ1K8WW+IbzKGTJSa0fCKkkl6tqqH5Jjfh/+aG7YpANvKA6xcSqFC9a2SpUNG3IAkAAABeeyJvcmlnaW4iOiJodHRwczovL25pY29sYXMtaG9pemV5LnBob3RvOjQ0MyIsImZlYXR1cmUiOiJQcmlvcml0eUhpbnRzQVBJIiwiZXhwaXJ5IjoxNjQ3OTkzNTk5fQ==
  Accept-CH: Downlink,RTT,Device-Memory,Save-Data,DPR,Width

Thanks a lot! :pray:
Photos on my site are from multiple cameras: Canon, Sony, Fujifilm