manifest-src
manifest-src specifies which web app manifests may be applied to the document.
It is the least eventful directive in a policy and the easiest to forget, which is why a strict default-src sometimes turns off a site’s install prompt with no visible error.
Syntax
Section titled “Syntax”Content-Security-Policy: manifest-src 'none';Content-Security-Policy: manifest-src <source-expression-list>;What it controls
Section titled “What it controls”<link rel="manifest">requests.
Fallback
Section titled “Fallback”If manifest-src is absent, the browser consults default-src. The full chain is manifest-src → default-src.
Recommended value
Section titled “Recommended value”Content-Security-Policy: manifest-src 'self'- A manifest is almost always same-origin. Setting it explicitly documents the intent and survives a later loosening of
default-src.
Examples
Section titled “Examples”Allowed
Section titled “Allowed”Under manifest-src 'self':
<link rel="manifest" href="/app.webmanifest" />Blocked
Section titled “Blocked”Under manifest-src 'self', a manifest served from a CDN:
<link rel="manifest" href="https://cdn.example.com/app.webmanifest" />Browser support
Section titled “Browser support”- Widely available across browsers since January 2020.
In a HeaderHawk report
Section titled “In a HeaderHawk report”| Field | Value |
|---|---|
violatedDirective |
manifest-src |
effectiveDirective |
manifest-src |
blockedUri |
https://cdn.example.com/app.webmanifest |
| Issue title | manifest-src blocking cdn.example.com |
- A handful of reports on this directive, all naming the same file, is the signature of a broken install prompt. There is no console-visible failure for users, so the report is the only signal you get.
Related directives
Section titled “Related directives”Getting reports for this directive
Section titled “Getting reports for this directive”Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.