# manifest-src (/en/docs/web-security/policies/content-security-policy/directives/manifest-src)



The `manifest-src` directive controls where the web app manifest can load from under a Content Security Policy (CSP). The manifest is the JSON file referenced by `<link rel="manifest">` that describes a progressive web app: its name, icons, theme color, and start URL.

A minimal safe policy for this directive:

```http
Content-Security-Policy: manifest-src 'self'
```

## Fallback chain [#fallback-chain]

`manifest-src` falls back to [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src). If you do not set `manifest-src`, the manifest is governed by whatever `default-src` allows. If neither is present, the manifest can load from anywhere.

## Values [#values]

`manifest-src` takes a space-separated source list combining [keyword sources](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), [host sources](/en/docs/web-security/policies/content-security-policy/values/csp-host-source), and [scheme sources](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source):

| Value             | Status  | Description                                                     |
| ----------------- | ------- | --------------------------------------------------------------- |
| `'none'`          | ✅ Good  | Blocks all manifest loads.                                      |
| `'self'`          | ✅ Good  | The manifest loads from the page's own origin. The usual value. |
| `cdn.example.com` | ✅ Good  | The exact CDN origin you serve the manifest from.               |
| `https:`          | ✅ Good  | Any HTTPS origin. Broad; prefer `'self'` or the exact host.     |
| `*`               | ❌ Risky | Lets an injected manifest link point at any host.               |

Nonces and hashes do not apply.

## Examples [#examples]

```http
Content-Security-Policy:
  default-src 'self';
  manifest-src 'self'
```

This allows the manifest to load only from your own origin, which is the usual case since the manifest almost always ships with the site.

## Common use [#common-use]

Most sites serve the manifest from their own origin, so `manifest-src 'self'` is the common value, and many sites simply let it fall back to `default-src`. You only need to name another host if you serve the manifest file from a CDN on a different origin. Note that manifest fetches are subject to the manifest's own CORS rules in addition to CSP, so a cross-origin manifest needs both allowed.

## Security notes [#security-notes]

The manifest is a low-risk, declarative resource: it cannot execute code, and a blocked manifest means the install and theming experience degrades rather than the page breaking. `manifest-src` is mainly an integrity control, keeping the manifest pinned to a host you trust so an injected `<link rel="manifest">` cannot swap in an attacker-controlled app description.

## Known bypasses and risks [#known-bypasses-and-risks]

The main risk is an over-broad source list that would let an injected manifest link point at an untrusted host. Keeping `manifest-src` at `'self'`, or to the specific CDN you use, removes that. There is no execution risk to bypass here, so this directive is straightforward.

## Recommendation [#recommendation]

```http
Content-Security-Policy: manifest-src 'self'
```

The manifest almost always ships with the site, so `'self'` covers most deployments. Name the exact CDN origin instead if you serve the manifest from one; there is no reason to allow anything broader for a single, well-known file.

## Reporting [#reporting]

When a manifest load is blocked, the browser sends a [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) with `manifest-src` as the `effectiveDirective`, including the blocked URL. CentralCSP collects and aggregates these reports, so a misconfigured or injected manifest link shows up as soon as it happens.

## Browser support [#browser-support]

`manifest-src` was added in CSP Level 3 and is supported in browsers that implement progressive web app manifests. Where a browser does not recognize it, the manifest falls back to `default-src`.

## See also [#see-also]

* [Content Security Policy directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives)
* [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src)
* [img-src](/en/docs/web-security/policies/content-security-policy/directives/img-src)
* [Host source values](/en/docs/web-security/policies/content-security-policy/values/csp-host-source)
* [CentralCSP CSP suite](/platform/csp-builder)

## Sources [#sources]

* [MDN, CSP manifest-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/manifest-src)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C CSP editor's draft](https://w3c.github.io/webappsec-csp/)