PWA: Prevent passing credentials to avoid redirection issues

For #4649
More of a patch around the issue for now.
Have opened #4656 to properly address.

diff --git a/app/App/PwaManifestBuilder.php b/app/App/PwaManifestBuilder.php
index 4902d354d28af01100312fa1b1b7f765bc6b3e38..ba4331a0f14522ab80f2bd2e93016941106409f4 100644 (file)
--- a/app/App/PwaManifestBuilder.php
+++ b/app/App/PwaManifestBuilder.php
@@ -6,6 +6,11 @@ class PwaManifestBuilder
 {
     public function build(): array
     {
+        // Note, while we attempt to use the user's preference here, the request to the manifest
+        // does not start a session, so we won't have current user context.
+        // This was attempted but removed since manifest calls could affect user session
+        // history tracking and back redirection.
+        // Context: https://github.com/BookStackApp/BookStack/issues/4649
         $darkMode = (bool) setting()->getForCurrentUser('dark-mode-enabled');
         $appName = setting('app-name');
 

diff --git a/resources/views/layouts/base.blade.php b/resources/views/layouts/base.blade.php
index 4acabbcaca3fc150ec60896d219a8b42f0224ffc..cf15e5426b832cebec6feadaec380272c68a635a 100644 (file)
--- a/resources/views/layouts/base.blade.php
+++ b/resources/views/layouts/base.blade.php
@@ -29,7 +29,7 @@
     <link rel="icon" type="image/png" sizes="32x32" href="{{ setting('app-icon-32') ?: url('/icon-32.png') }}">
 
     <!-- PWA -->
-    <link rel="manifest" href="{{ url('/manifest.json') }}" crossorigin="use-credentials">
+    <link rel="manifest" href="{{ url('/manifest.json') }}">
     <meta name="mobile-web-app-capable" content="yes">
 
     @yield('head')

diff --git a/tests/PwaManifestTest.php b/tests/PwaManifestTest.php
index ad94790481cfa1ff80b3b03c7ee6c54e1d04a863..c66f8b36052b18d1c13e1e83a49b97dd1d363916 100644 (file)
--- a/tests/PwaManifestTest.php
+++ b/tests/PwaManifestTest.php
@@ -24,9 +24,7 @@ class PwaManifestTest extends TestCase
     {
         $html = $this->asViewer()->withHtml($this->get('/'));
 
-        // crossorigin attribute is required to send cookies with the manifest,
-        // so it can react correctly to user preferences (dark/light mode).
-        $html->assertElementExists('head link[rel="manifest"][href$="manifest.json"][crossorigin="use-credentials"]');
+        $html->assertElementExists('head link[rel="manifest"][href$="manifest.json"]');
         $html->assertElementExists('head meta[name="mobile-web-app-capable"][content="yes"]');
     }