Overview

manifest-src controls the origins from which a web app manifest (<link rel="manifest" href="...">) may be loaded — the manifest.json that provides PWA install metadata. When omitted it inherits from default-src.

Details

Most PWAs serve the manifest from their own origin, so manifest-src 'self' suffices. The manifest file is JSON describing app name, icons, start URL, and display mode; note that the icon images referenced inside it are governed by img-src, not manifest-src.

If you serve the manifest from another origin (e.g., a CDN), you must name that host for it to load. Under a strict policy (default-src 'none'), failing to open manifest-src can suppress the PWA install prompt, so verify it.

Syntax

Content-Security-Policy: manifest-src 'self'

Notes

• manifest-src 'self' is usually enough since manifests are typically served same-origin.
• Icon images inside the manifest are governed by img-src, not manifest-src.
• Under strict policies like default-src 'none', not opening manifest-src can block PWA installation.

Related directives