Connection scope

• http://localhost:<port>
• http://127.0.0.1:<port>
• ws://localhost:<port>
• ws://127.0.0.1:<port>

Cross-origin requests

Access-Control-Allow-Origin: mnpanel://panel

Navigation

• When the user clicks an http: or https: link, the address is handed to the system browser and the panel does not navigate.
• Changing location from the page, or submitting a form, has no effect. Use fetch to send data to a server.

Content security policy

• Loading: same-origin panel resources, mnpanel:, https:, and HTTP resources from localhost and 127.0.0.1. This covers scripts, styles, images, fonts, audio/video, and iframes.
• Connections: same-origin panel resources, mnpanel:, https:, wss:, local HTTP, local WebSocket, data:, and blob:.
• Additional sources: images and media may also use data: and blob:; fonts may also use data:.
• Blocked: object tags, <base> tags, and form submission.

default-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:*
connect-src 'self' mnpanel: https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:* data: blob:
script-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:* 'unsafe-inline' 'unsafe-eval'
style-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:* 'unsafe-inline'
img-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:* data: blob:
media-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:* data: blob:
font-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:* data:
frame-src 'self' mnpanel: https: http://localhost:* http://127.0.0.1:*
object-src 'none'
base-uri 'none'
form-action 'none'