1. headers http header: content-security-policy: script-src: source expression allowing webassembly execution