[PR #5820] [MERGED] Fix PWA manifest access behind authenticated proxies #6575

New Issue

OVERLORD · 2026-02-05T10:35:54+03:00

OVERLORD commented

2026-02-05 10:35:54 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/5820
Author: @tfnh621
Created: 10/2/2025
Status: ✅ Merged
Merged: 10/5/2025
Merged by: @ssddanbrown

Base: development ← Head: patch-1

📝 Commits (1)

fcef1a7 Add crossorigin attribute to manifest link

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 resources/views/layouts/base.blade.php (+1 -1)

📄 Description

In environments where BookStack is served behind an authenticated proxy (such as Cloudflare Zero Trust), the browser fails to fetch manifest.json since credentials are not sent by default.
As a result, PWA installation and functionality do not work.

This PR resolves the issue by adding crossorigin="use-credentials" to the <link rel="manifest"> tag, ensuring credentials are included when the manifest is requested.

Reference:
https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest#deploying_a_manifest

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/5820 **Author:** [@tfnh621](https://github.com/tfnh621) **Created:** 10/2/2025 **Status:** ✅ Merged **Merged:** 10/5/2025 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `development` ← **Head:** `patch-1` --- ### 📝 Commits (1) - [`fcef1a7`](https://github.com/BookStackApp/BookStack/commit/fcef1a7948bff6da083f7d727fbcbf269fbe9252) Add crossorigin attribute to manifest link ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `resources/views/layouts/base.blade.php` (+1 -1) </details> ### 📄 Description In environments where BookStack is served behind an authenticated proxy (such as Cloudflare Zero Trust), the browser fails to fetch `manifest.json` since credentials are not sent by default. As a result, PWA installation and functionality do not work. This PR resolves the issue by adding `crossorigin="use-credentials"` to the `<link rel="manifest">` tag, ensuring credentials are included when the manifest is requested. Reference: https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest#deploying_a_manifest --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:35:54 +03:00

OVERLORD closed this issue

2026-02-05 10:35:55 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6575