Web App Manifest blocked by CORS when hosted behind authentication
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- web-dev
Research direction
Locate the template for the generated index.html file and inspect how the manifest link is emitted. Reproduce the issue with the starter app behind authentication, then verify that the authenticated manifest request succeeds with the expected credentials behavior.
Written by the indexing model from the issue text.
Description
Stencil version:
@stencil/core@1.2.3
I'm submitting a:
[x] bug report
[ ] feature request
[ ] support request
Current behavior:
Currently, when deploying a Stencil site / app to a host behind authentication, the manifest file fails to load with the following error:
Access to manifest at 'https://path.to/my-site/manifest.json' from origin 'https://path.to' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Expected behavior:
The manifest should be loaded with crossorigin="use-credentials" so that the browser sends the auth credentials when requesting the manifest. See MDN for details.
Steps to reproduce:
- Deploy the starter app to a location that is behind authentication.
- Open DevTools and observe that the manifest does not load due to a CORS error.
Other information:
I'm not sure where the template for the generated index.html file lives, but I believe this fix should be as simple as changing:
<link rel="manifest" href="./manifest.json">
to
<link rel="manifest" href="./manifest.json" crossorigin="use-credentials">
- Dominant language
- TypeScript
- Stars
- 13.1k
- Forks
- 855
- Avg merge
- 4h 7m
- Merged PRs (30d)
- 44
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stenciljs/core
-
Stencil v5
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Stencil v5
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Bug: Validated Stencil v5
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Feature: Want this? Upvote it!
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Feature: Want this? Upvote it!
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Similar issues
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
code-quality refactoring
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
github/gh-aw-firewall#8816 ·
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
vercel/react-tweet#225 ·