From 1a41ca3c7d888fd3c0ae17d461c5e1de716e0756 Mon Sep 17 00:00:00 2001
From: Arthur Fiorette <47537704+arthurfiorette@users.noreply.github.com>
Date: Mon, 23 Mar 2026 06:37:07 -0300
Subject: [PATCH] Enable cross-origin manifest to make PWA work behind
 Cloudflare Access (#734)

* feat: add crossOrigin use-credentials to PWA manifest link for Cloudflare Access compatibility

* docs: add inline comment explaining crossOrigin use-credentials on manifest link

Co-authored-by: arthurfiorette <47537704+arthurfiorette@users.noreply.github.com>
---
 packages/web/index.html | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/web/index.html b/packages/web/index.html
index 049e1cdb..20ef4d63 100644
--- a/packages/web/index.html
+++ b/packages/web/index.html
@@ -198,6 +198,9 @@
 
       const manifestLink = document.createElement('link');
       manifestLink.rel = 'manifest';
+      // Required so the browser sends auth cookies when fetching the manifest,
+      // enabling PWA installation behind authentication proxies (e.g. Cloudflare Access).
+      manifestLink.crossOrigin = 'use-credentials';
       document.head.appendChild(manifestLink);
 
       let activeManifestBlobUrl = null;