From 0fbb0f8fa804e09254bf2f56c38c71e50229e5c7 Mon Sep 17 00:00:00 2001 From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com> Date: Mon, 20 Jul 2026 13:37:26 +0200 Subject: [PATCH] fix(pwa): exclude manifest.webmanifest from auth middleware (#1078) The middleware matcher excluded the legacy manifest.json path, but the app serves its manifest from app/manifest.ts at /manifest.webmanifest. Browsers fetch manifests without credentials, so every manifest request hit the auth gate and 307-redirected to /login, making the PWA uninstallable for all users (logged in or not). Verified locally: /manifest.webmanifest returns 200 JSON, /dashboard still redirects to /login. Co-authored-by: Claude Fable 5 --- proxy.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proxy.ts b/proxy.ts index cb10efa9..28fbf485 100644 --- a/proxy.ts +++ b/proxy.ts @@ -18,6 +18,6 @@ export const config = { * (AAL2) gate on cookie-authenticated API calls (updateSession short- * circuits API routes after that check: see lib/supabase/middleware.ts). */ - '/((?!_next/static|_next/image|favicon.ico|\\.well-known|sw\\.js|sw-register\\.js|manifest\\.json|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)', + '/((?!_next/static|_next/image|favicon.ico|\\.well-known|sw\\.js|sw-register\\.js|manifest\\.json|manifest\\.webmanifest|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)', ], }