wallet-to-go/index.html at main · tutanch/wallet-to-go · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover">
    <!--
        CSP changes from original:
        - Removed 'unsafe-eval' (WASM only needs 'wasm-unsafe-eval')
        - Removed https://cdn.jsdelivr.net from all directives (assets now self-hosted)
        - Added frame-src for keyguard iframe origin
        Replace [KEYGUARD_ORIGIN] before deploying, e.g. https://nimiq-wallet-keyguard.github.io
    -->
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-pJC4gS7fEJ2sD+197b4a+ot2JC9A5BR+IiRkBc7vMMk='; style-src 'self' 'unsafe-inline'; connect-src 'self' wss:; worker-src 'self' blob:; frame-src [KEYGUARD_ORIGIN]; img-src 'self' data:; form-action 'self'; base-uri 'self'; object-src 'none'">
    <title>Nimiq Wallet</title>
    <link rel="icon" href="public/favicon.svg" type="image/svg+xml">
    <link rel="stylesheet" href="src/styles/app.css">
    <!-- Security init MUST load before any other scripts -->
    <script src="src/security-init.js"></script>
</head>
<body class="nq-blue-bg">
    <!--
        Keyguard iframe — cross-origin, hidden by default.
        Shown as full-screen overlay when user interaction is needed (signing, etc.).
        sandbox: allow-same-origin lets keyguard access its own IndexedDB.
        Replace [KEYGUARD_ORIGIN] before deploying.
    -->
    <iframe
        id="keyguard-frame"
        src="[KEYGUARD_ORIGIN]"
        style="display:none; position:fixed; inset:0; width:100%; height:100%; border:none; z-index:9999;"
        sandbox="allow-scripts allow-same-origin allow-forms"
        title="Nimiq Keyguard"
    ></iframe>
    <div id="app">
        <div class="loading-screen">
            <h1 class="nq-h1">Loading Nimiq...</h1>
            <p class="nq-text">Initializing wallet</p>
        </div>
    </div>
    <script type="importmap">
    {
        "imports": {
            "@nimiq/core": "./lib/nimiq-core/web/index.js"
        }
    }
    </script>
    <script type="module" src="src/main.js"></script>
</body>
</html>