customHeaders: - pattern: /** headers: - key: Content-Security-Policy value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.tosspayments.com https://js.tosspayments.com; style-src 'self' 'unsafe-inline' https://*.tosspayments.com; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https://*.tosspayments.com; frame-src 'self' https://*.tosspayments.com" - pattern: /purchase/** headers: - key: Cache-Control value: no-store, no-cache, must-revalidate - pattern: /api/payment/** headers: - key: Cache-Control value: no-store, no-cache, must-revalidate