Safety
CSP manifest-src vs Web App Manifest for Public Sites
January 2, 2023
CSP manifest-src vs a web app manifest for public sites is two different files' jobs. The manifest is a public JSON document (often /manifest.json or a link rel=manifest) that names name, icons, start_url, and display mode. It is supposed to be fetchable. manifest-src in Content-Security-Policy lists which origins may be used as that manifest — including 'self' for a first-party file. A tight manifest-src does not hide secrets you put in the JSON. package.json on the CDN is inventory, not a PWA manifest. RoastMyOpsec does not score missing manifest-src as a standalone F, does not treat a public manifest as a leak by itself, and does not fetch every icon URL in the file.
The practical difference
The manifest is metadata. manifest-src is which host may supply it. default-src covers the manifest if you omit manifest-src. img-src covers icons the manifest points at, not the JSON. connect-src is APIs, not the manifest fetch.
A brochure without a PWA can skip the file. If you ship one, keep it first-party and keep API keys out of it.
How to choose manifest-src
First-party PWA: manifest-src 'self'. Manifest hosted on a static CDN: name that HTTPS host, not *. No PWA: omit the link and omit the directive. Report-Only first if a theme injects a surprise manifest host. Pair with assetlinks if you also claim Android/iOS association files.
| Control | What it limits | Does not replace | Takeaway |
|---|---|---|---|
| Public /manifest.json | PWA metadata | manifest-src | Meant to be public; no secrets |
| manifest-src allowlist | Which hosts may be the manifest | Icon hosts | Name 'self' or one CDN |
| img-src | Icons and stills | manifest-src | See img-src vs mixed content |
| /package.json | npm inventory | A PWA manifest | Deny on the marketing origin |
When a third-party manifest still appears
Some builders inject a vendor manifest URL. Prefer copying the JSON to your origin. Missing manifest-src is not a finding if default-src is already tight. Pair with web app manifest vs public metadata if the JSON itself holds internal hosts.
What the roast can prove
CSP quality signals can surface. Missing manifest-src is not scored as its own finding. A reachable /package.json can still be inventory. Confirm the manifest link and the directive yourself.
Common mistakes
The first mistake is manifest-src * because a theme kept moving the JSON.
The second mistake is putting API keys or staging hostnames in the public manifest.
The third mistake is treating a public manifest as the same leak as package.json.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a public web app manifest a vulnerability?
- No. Manifests are meant to be public. Secrets inside the JSON are the miss.
- Should brochure sites set manifest-src?
- If you have CSP and a first-party manifest, 'self' is enough. Missing it is not a roast F if default-src is tight.
- Does RoastMyOpsec score manifest-src?
- No. It grades CSP quality overall and does not treat /manifest.json as a scored leak path.