mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-09 17:37:20 -06:00
Inline the web app manifest as a `data:` URL instead of serving it from `/assets/site-manifest.json`. That endpoint has been linked through `STATIC_URL_PREFIX` since https://github.com/go-gitea/gitea/pull/37405 and fails to load when: 1. a reverse proxy checks auth on every request, because browsers fetch manifests without cookies 2. `STATIC_URL_PREFIX` serves the `public/` directory from disk, which has no such file 3. `STATIC_URL_PREFIX` is cross-origin, because the endpoint sends no CORS headers The manifest is built per request so `start_url` follows `PUBLIC_URL_DETECTION`. A reverse proxy that adds a stricter CSP must allow `manifest-src data:`. Fixes https://github.com/go-gitea/gitea/issues/40197 --------- Co-authored-by: silverwind <me@silverwind.io>