Repository navigation
fix(web): serve the manifest as a file so the relay csp allows it - #95
Merged
Merged
Conversation
Chrome on Android refused to install the web app from any relay. The page gave its manifest as a data: URL. The CSP from dcolinmorgan#82 names no manifest-src, so the fetch falls back to default-src 'self', which blocks data:. Chrome then finds no manifest and offers only a shortcut. Move the manifest to web/manifest.webmanifest and link to it. The CSP stays as it is, because default-src 'self' covers a same-origin file. The relay serves .webmanifest as application/manifest+json with no-cache. The file needs no token, which matters because Chrome fetches a manifest with no credentials. test_web_install.py serves the page with the relay's real CSP and asks Chrome through CDP for the manifest and the installability errors. On the old page it reports no-manifest. With this change it reports none.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chrome on Android refuses to install the web app from any relay. It shows "This app cannot be installed" and offers only a browser shortcut.
Cause
web/index.htmlgives the manifest as adata:application/json,...URL. The CSP from #82 (WEB_APP_CSP) names nomanifest-src, so the manifest fetch falls back todefault-src 'self', which blocksdata:. Chrome finds no manifest.Fix
web/manifest.webmanifest, with the same content, and link to it..webmanifestfrom the relay asapplication/manifest+jsonwithno-cache.default-src 'self'covers a same-origin manifest.The manifest needs no token, because it goes through
web_assetlike the icons. That matters, because Chrome fetches a manifest with no credentials.Tests
tests/test_web_install.py: serves the page with the relay's real CSP and content types. It asks Chrome through CDP forPage.getAppManifestandPage.getInstallabilityErrors. Onmainit reportsno-manifestandmanifest-parsing-or-network-error. With this change it reports none. It skips where no Chrome is found, the same as the other browser tests.tests/test_web_pwa.py: reads the manifest file, and checks that the relay serves it with no token whileHERDR_RELAY_TOKENis set.tests/test_web_assets.pyandtests/test_web_theme.py: follow the manifest into its file.tests/run.shpasses.Checked by hand
wrangler pages dev webserves the file asapplication/manifest+json, and Chrome reads it with no errors.