⫘⫘⫘⫘⫘⫘⫘⫘⫘⫘⫘ =^._.^= randomx_bonanza v0.1.0-alpha ⫘⫘⫘⫘⫘⫘⫘⫘⫘⫘⫘
| Endpoint | Configuration |
|---|---|
| Host page | HTTPS. Set COOP and COEP on the HTML response. These headers enable the shared memory used by WASM threads. |
| Static assets | Publish the complete dist/ directory to the script URL’s pinned release. For your own asset server, send the CORS and CORP headers below on JavaScript and WASM responses, including redirects. |
| Pool proxy | Use wss:// on HTTPS pages. Forward WebSocket upgrades to the bridge. This bridge uses a pool/port URL query; choose Fixed endpoint for proxies that select their pool internally. Match the disclosed pool to that endpoint. Message frames carry XMRig-shaped login, job and submit JSON-RPC. Native WebSocket ping/pong checks the transport. |
HTML response headers
Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp
Cross-origin static asset response headers
Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: application/javascript # .js Content-Type: application/wasm # .wasm
Generated scripts use crossorigin="anonymous"; asset requests omit cross-origin credentials. CORS belongs on the asset server. Adding it to the host page alone does not grant access to another server’s files.
For an existing Content Security Policy, allow the asset origin in script-src and connect-src, the proxy in connect-src, and blob: workers. Example for jsDelivr:
script-src 'self' https://cdn.jsdelivr.net blob: 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self' https://cdn.jsdelivr.net wss://YOUR_PROXY;
Authorize inline initialization with your site’s script nonce or hash. For the widget stylesheet, pass a matching nonce and allow it in style-src. Keep your existing CSP directives. Browsers needing the broader WASM permission may require 'unsafe-eval'.
COEP also applies to other resources on the page: external scripts, fonts and images must support CORS or an appropriate CORP policy. WebSockets use an Origin header rather than CORS preflight; allow the embedding site in your proxy’s origin policy.
Verify in the embedding page’s console:
window.isSecureContext === true window.crossOriginIsolated === true typeof SharedArrayBuffer === 'function'
If isolation is false, check the HTML response headers and any Permissions-Policy restriction on cross-origin-isolated. If assets fail, inspect their CORS/CORP headers and CSP errors. If the proxy fails, check TLS, its Origin policy, and the HTTP 101 upgrade response. Safari’s local demo needs HTTPS; a CDN script cannot supply isolation headers for its host page.