Skip to main content
If your pages send a Content-Security-Policy header, it must allow your game server. A page without a policy needs nothing on this page. The games load as JavaScript modules from your game server, talk to it over https and WebSocket, fetch their sounds and 3D models from it, and load images and fonts from it. The Provably fair dialog recomputes outcomes with WebAssembly and asks a public Solana RPC for each bet’s record.

​
Directives

Merge these into your policy, with your game server’s host in place of og-rgs-lucky-star.luckystar.workers.dev:
The Put the games on your page step on Integration shows these directives with your game server’s host filled in, under Content Security Policy, for pages that send one, below the code. With several game servers, they follow the one chosen in Game server. The instructions for your coding agent list them for every game server you have.
Browsers ignore 'unsafe-inline' in a style-src that also lists a nonce or a hash, and the games then load without their styles. The pages that show the games need a style-src without a nonce or a hash. A policy with default-src and no style-src applies default-src to styles too: add style-src with 'unsafe-inline'.
Your session endpoint is on your own origin, so 'self' covers it. If it is on another origin, add that origin to connect-src.

​
A complete example

A page on https://www.luckystar.example that shows the games from https://og-rgs-lucky-star.luckystar.workers.dev. Besides the directives above, it sets default-src, object-src and base-uri of its own:

​
When the policy blocks something

The browser’s console names every refusal, for example Refused to load the script 'https://og-rgs-lucky-star.luckystar.workers.dev/element/v1/loader.js' because it violates the following Content Security Policy directive. Troubleshooting lists each refusal and its fix. Your game server checks the page’s origin separately from your policy: the origin must also be in Allowed origins, under Players and sessions in Settings.