github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 11:37:49 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[GH-ISSUE #2209] Web app manifest and 401 status code (Unauthorized) #6595

New Issue
Closed
opened 2026-04-20 17:11:33 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-04-20 17:11:33 -05:00
Owner
Copy Link

Originally created by @rhclayto on GitHub (Feb 9, 2026).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2209

Pre-submission checklist

  • I have searched for existing open or closed issue reports with the same problem.

Description

I ran into this issue (see below). It's an easy change but I don't know if there are security or other implications, & it cannot be user configurable because it must be changed before building the frontend, unless there is some other way of doing this. Is this something that Vikunja would like to do? If so I can do a PR.

From https://vite-pwa-org.netlify.app/guide/faq.html#web-app-manifest-and-401-status-code-unauthorized :

Browsers send requests for the web manifest without credentials] https://web.dev/articles/add-manifest#link-manifest), so if your site sits behind auth, the request will fail with a 401 Unauthorized error – even if the user is logged in.

To send the request with credentials, the needs a crossorigin="use-credentials" attribute, which you can enable via useCredentials in the plugin options:

useCredentials: true

Vikunja Version

v1.0.0

Browser and version

Firefox/Chrome/any browser

Can you reproduce the bug on the Vikunja demo site?

No

Screenshots

No response

Originally created by @rhclayto on GitHub (Feb 9, 2026). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2209 ### Pre-submission checklist - [x] I have searched for existing open or closed issue reports with the same problem. ### Description I ran into this issue (see below). It's an easy change but I don't know if there are security or other implications, & it cannot be user configurable because it must be changed before building the frontend, unless there is some other way of doing this. Is this something that Vikunja would like to do? If so I can do a PR. From https://vite-pwa-org.netlify.app/guide/faq.html#web-app-manifest-and-401-status-code-unauthorized : Browsers send requests for the web manifest without credentials] https://web.dev/articles/add-manifest#link-manifest), so if your site sits behind auth, the request will fail with a 401 Unauthorized error – even if the user is logged in. To send the request with credentials, the <link rel="manifest"> needs a crossorigin="use-credentials" attribute, which you can enable via useCredentials in the [plugin options](https://github.com/antfu/vite-plugin-pwa/blob/main/src/types.ts#L79): `useCredentials: true` ### Vikunja Version v1.0.0 ### Browser and version Firefox/Chrome/any browser ### Can you reproduce the bug on the Vikunja demo site? No ### Screenshots _No response_
GiteaMirror added the waiting for reply label 2026-04-20 17:11:33 -05:00
GiteaMirror commented 2026-04-20 17:11:36 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Feb 9, 2026):

What exactly was the issue that you ran into?

<!-- gh-comment-id:3870391717 --> @kolaente commented on GitHub (Feb 9, 2026): What exactly was the issue that you ran into?
GiteaMirror commented 2026-04-20 17:11:36 -05:00
Author
Owner
Copy Link

@rhclayto commented on GitHub (Feb 9, 2026):

I have Vikunja behind Authelia, so all routes are protected by cookie auth. By default, the browser doesn't include credentials (here, cookies) with web manifest requests, so those equests are rejected, the browser doesn't get a manifest.json. Changing the Vite setting makes web manifests get sent with credentials, making PWAs work behind auth.

<!-- gh-comment-id:3873094022 --> @rhclayto commented on GitHub (Feb 9, 2026): I have Vikunja behind Authelia, so all routes are protected by cookie auth. By default, the browser doesn't include credentials (here, cookies) with web manifest requests, so those equests are rejected, the browser doesn't get a manifest.json. Changing the Vite setting makes web manifests get sent with credentials, making PWAs work behind auth.
GiteaMirror commented 2026-04-20 17:11:36 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Feb 9, 2026):

Gotcha. That makes more sense now.

Do you want to send a PR?

<!-- gh-comment-id:3874157765 --> @kolaente commented on GitHub (Feb 9, 2026): Gotcha. That makes more sense now. Do you want to send a PR?
GiteaMirror commented 2026-04-20 17:11:37 -05:00
Author
Owner
Copy Link

@rhclayto commented on GitHub (Feb 9, 2026):

🫡

<!-- gh-comment-id:3874457460 --> @rhclayto commented on GitHub (Feb 9, 2026): 🫡
GiteaMirror commented 2026-04-20 17:11:38 -05:00
Author
Owner
Copy Link

@rhclayto commented on GitHub (Feb 9, 2026):

https://github.com/go-vikunja/vikunja/pull/2218

<!-- gh-comment-id:3874523783 --> @rhclayto commented on GitHub (Feb 9, 2026): https://github.com/go-vikunja/vikunja/pull/2218
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label waiting for reply
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6595
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?