77 lines
3.1 KiB
Markdown
77 lines
3.1 KiB
Markdown
# Static-hosting headers
|
|
|
|
Serve the release over HTTPS. Apply these headers to the app entry, wrapper
|
|
worker, both core modes and every generated result page:
|
|
|
|
```text
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Embedder-Policy: require-corp
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
X-Content-Type-Options: nosniff
|
|
Referrer-Policy: no-referrer
|
|
X-Frame-Options: DENY
|
|
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
|
|
Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; font-src 'self'; style-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
|
|
```
|
|
|
|
The multithread core requires all three cross-origin headers. Without them the
|
|
app must select the single-thread core; the rest of the app still works. Never
|
|
add broad `'unsafe-eval'`: WebAssembly needs only `'wasm-unsafe-eval'`.
|
|
|
|
Response types:
|
|
|
|
```text
|
|
*.wasm Content-Type: application/wasm
|
|
*.js Content-Type: text/javascript
|
|
*.mjs Content-Type: text/javascript
|
|
*.json Content-Type: application/json
|
|
```
|
|
|
|
All FFmpeg JS/WASM/worker files must be same-origin. A CDN requires careful
|
|
cross-origin resource policy and is outside the supported deployment profile.
|
|
|
|
Use `no-cache` for `index.html`, `toolbox-app.json`, notices and other stable
|
|
names. The files under the exact version directory
|
|
`vendor/ffmpeg/0.12.10/{st,mt}/` are content-verified and may use:
|
|
|
|
```text
|
|
Cache-Control: public, max-age=31536000, immutable
|
|
```
|
|
|
|
Vite files whose names include their content hash under `assets/` may use the
|
|
same immutable policy. Do not make mutable or unversioned files immutable.
|
|
|
|
For a host with a `_headers`-style configuration, adapt:
|
|
|
|
```text
|
|
/av/*
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Embedder-Policy: require-corp
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
X-Content-Type-Options: nosniff
|
|
Referrer-Policy: no-referrer
|
|
X-Frame-Options: DENY
|
|
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
|
|
Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; font-src 'self'; style-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
|
|
Cache-Control: no-cache
|
|
|
|
/av/vendor/ffmpeg/0.12.10/*
|
|
Cache-Control: public, max-age=31536000, immutable
|
|
|
|
/av/assets/*
|
|
Cache-Control: public, max-age=31536000, immutable
|
|
```
|
|
|
|
Confirm the provider can override `.wasm` to `application/wasm`; many
|
|
`_headers` formats set headers but cannot correct MIME mappings. Validate a
|
|
real response rather than relying only on configuration:
|
|
|
|
```sh
|
|
curl -sSI https://tools.example.test/av/ | sed -n '1,30p'
|
|
curl -sSI https://tools.example.test/av/vendor/ffmpeg/0.12.10/st/ffmpeg-core.wasm | sed -n '1,30p'
|
|
```
|
|
|
|
In browser developer tools, also verify `window.crossOriginIsolated === true`,
|
|
that core URLs remain below the nested `/av/` path, and that no runtime request
|
|
targets a CDN.
|