manifest-src

The manifest-src directive controls where the web app manifest can load from under a Content Security Policy (CSP). The manifest is the JSON file referenced by <link rel="manifest"> that describes a progressive web app: its name, icons, theme color, and start URL.

A minimal safe policy for this directive:

Content-Security-Policy: manifest-src 'self'

Fallback chain

manifest-src falls back to default-src. If you do not set manifest-src, the manifest is governed by whatever default-src allows. If neither is present, the manifest can load from anywhere.

Values

manifest-src takes a space-separated source list combining keyword sources, host sources, and scheme sources:

Nonces and hashes do not apply.

Examples

Content-Security-Policy:
  default-src 'self';
  manifest-src 'self'

This allows the manifest to load only from your own origin, which is the usual case since the manifest almost always ships with the site.

Common use

Most sites serve the manifest from their own origin, so manifest-src 'self' is the common value, and many sites simply let it fall back to default-src. You only need to name another host if you serve the manifest file from a CDN on a different origin. Note that manifest fetches are subject to the manifest's own CORS rules in addition to CSP, so a cross-origin manifest needs both allowed.

Security notes

The manifest is a low-risk, declarative resource: it cannot execute code, and a blocked manifest means the install and theming experience degrades rather than the page breaking. manifest-src is mainly an integrity control, keeping the manifest pinned to a host you trust so an injected <link rel="manifest"> cannot swap in an attacker-controlled app description.

Known bypasses and risks

The main risk is an over-broad source list that would let an injected manifest link point at an untrusted host. Keeping manifest-src at 'self', or to the specific CDN you use, removes that. There is no execution risk to bypass here, so this directive is straightforward.

Recommendation

Content-Security-Policy: manifest-src 'self'

The manifest almost always ships with the site, so 'self' covers most deployments. Name the exact CDN origin instead if you serve the manifest from one; there is no reason to allow anything broader for a single, well-known file.

Reporting

When a manifest load is blocked, the browser sends a csp-violation report with manifest-src as the effectiveDirective, including the blocked URL. CentralCSP collects and aggregates these reports, so a misconfigured or injected manifest link shows up as soon as it happens.

Browser support

manifest-src was added in CSP Level 3 and is supported in browsers that implement progressive web app manifests. Where a browser does not recognize it, the manifest falls back to default-src.

See also

• Content Security Policy directives
• default-src
• img-src
• Host source values
• CentralCSP CSP suite

Sources

• MDN, CSP manifest-src
• W3C, Content Security Policy Level 3
• W3C CSP editor's draft