Checkpoint web parity through Chromium input tasks
This commit is contained in:
@@ -8,11 +8,16 @@ when every response, including errors and SPA fallbacks, preserves these headers
|
||||
| `Cross-Origin-Opener-Policy` | `same-origin` |
|
||||
| `Cross-Origin-Embedder-Policy` | `require-corp` |
|
||||
| `Cross-Origin-Resource-Policy` | `same-origin` |
|
||||
| `Content-Security-Policy` | `default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'; connect-src 'self'; font-src 'self'; img-src 'self'; media-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'` |
|
||||
|
||||
Production uses HTTPS. Loopback development may use `http://127.0.0.1`; `file://` is unsupported.
|
||||
Runtime assets are same-origin. A reverse proxy must not strip the isolation, range, cache, MIME or
|
||||
ETag headers.
|
||||
|
||||
The CSP permits WebAssembly compilation only through the explicit `wasm-unsafe-eval` source expression;
|
||||
JavaScript `eval` and `new Function` remain denied. Workers, fonts, images and media are each limited to
|
||||
same-origin resources, and `data:`/`blob:` URLs are not declared for any of them.
|
||||
|
||||
## Empty-directory install runbook
|
||||
|
||||
The release delivery contains `blender-web-offline.tar.gz`,
|
||||
|
||||
Reference in New Issue
Block a user