ai-pong-game/index.html at main · MHarrisT/ai-pong-game · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <!-- SEO -->
    <title>AI Pong Game — Real-Time Multiplayer</title>
    <meta name="description" content="Play real-time multiplayer Pong in your browser. Share a room code with a friend and battle to 11 points. No sign-up required." />
    <meta property="og:title" content="AI Pong Game — Real-Time Multiplayer" />
    <meta property="og:description" content="Play real-time multiplayer Pong in your browser. Share a room code with a friend and battle to 11 points." />
    <meta property="og:type" content="website" />

    <!--
      Content Security Policy (meta-tag fallback for development / static hosting).
      The nginx.conf enforces the same policy server-side in production.

      Directives:
        default-src 'self'                      — block all unknown origins by default
        script-src  'self' 'unsafe-inline'      — Vite/React needs inline bootstrap scripts
        style-src   'self' 'unsafe-inline' https://fonts.googleapis.com
        font-src    'self' https://fonts.gstatic.com
        connect-src 'self' https://*.supabase.co wss://*.supabase.co
                                                — Supabase REST + Realtime WS
        img-src     'self' data:                — canvas toDataURL() needs data:
        frame-ancestors 'none'                  — clickjacking protection
        object-src  'none'                      — block Flash / plugins
        base-uri    'self'                      — prevent base-tag hijacking
    -->
    <meta
      http-equiv="Content-Security-Policy"
      content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://*.supabase.co wss://*.supabase.co; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'; base-uri 'self';"
    />

    <!-- Google Fonts: Orbitron for the retro-futuristic game UI -->
    <link rel="preconnect" href="https://fonts.googleapis.com" />
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
    <link
      href="https://fonts.googleapis.com/css2?family=Orbitron:wght@400;700;900&display=swap"
      rel="stylesheet"
    />
  </head>
  <body>
    <div id="root"></div>
    <script type="module" src="/src/main.jsx"></script>
  </body>
</html>