Static, self-contained page. It only sends requests to the loopback target below, which should be a
synthetic echo (never a real wallet proxy). Each row sends from one context: the top-level page, or a
frame built like the anon-rpc browser harness (sandbox="allow-scripts" + srcdoc,
opaque origin), and a blob Web Worker inside that frame. Rows differ only in the iframe
allow attribute.
Target:
top-level origin: UA:
Permission state (top level):
| case | iframe allow | context | policy allows loopback-network | json → /null (preflighted, readable if reached) | text/plain → /none (simple, unreadable) |
|---|