bundles/org.openhab.ui/web/src/index.html

<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <!--
  Customize this policy to fit your own app's needs. For more guidance, see:
      https://github.com/apache/cordova-plugin-whitelist/blob/master/README.md#content-security-policy
  Some notes:
    * gap: is required only on iOS (when using UIWebView) and is needed for JS->native communication
    * https://ssl.gstatic.com is required only on Android and is needed for TalkBack to function properly
    * Disables use of inline scripts in order to mitigate risk of XSS vulnerabilities. To change this:
      * Enable inline JS: add 'unsafe-inline' to default-src
  -->
  <meta http-equiv="Content-Security-Policy" content="default-src * 'self' 'unsafe-inline' 'unsafe-eval' data: gap: content: blob:; style-src 'self' 'unsafe-inline';">
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, minimal-ui, viewport-fit=cover">

  <meta name="theme-color" content="#e64a19">
  <meta name="format-detection" content="telephone=no">
  <meta name="msapplication-tap-highlight" content="no">
  <title>openHAB</title>
  <% if (process.env.TARGET === 'web') { %>
  <meta name="apple-mobile-web-app-capable" content="yes">
  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
  <link rel="apple-touch-icon" href="images/icons/apple-touch-icon.png" type="image/png" sizes="180x180" crossorigin="use-credentials">
  <link rel="icon" href="images/icons/favicon.svg" type="image/svg+xml" sizes="any" crossorigin="use-credentials">
  <link rel="icon" href="images/icons/128x128.png" type="image/png" sizes="128x128" crossorigin="use-credentials">
  <link rel="manifest" href="manifest.json" crossorigin="use-credentials">
  <% } %>
  <!-- built styles file will be auto injected -->
  <script>
    const baseUrl = document.cookie.match('(^|;)\\s*X-OPENHAB-BASEURL\\s*=\\s*([^;]+)')?.pop().replace(/\/$/, '') || '';

    var base = document.createElement('base');
    base.href = baseUrl + '/';
    document.head.appendChild(base);
  </script>
</head>
<body>
  <div id="app"></div>
  <% if (process.env.TARGET === 'cordova') { %>
  <script src="cordova.js"></script>
  <% } %>
  <script>
    let app = document.createElement('script');
    app.setAttribute('src', baseUrl + "/js/app.js");
    document.body.appendChild(app);
  </script>
</body>
</html>