Can't install as PWA behind Cloudflare Access

[samvrlewis]

What happened?

First of all, thanks for the project!

If Librechat is hosted behind Cloudflare access then I get the following error in the browser console

Access to manifest at 'https://myteam.cloudflareaccess.com/<..snip..>' (redirected from 'https://mylibrechaturl/manifest.webmanifest') from origin 'https://mylibrechaturl' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Which means I can't install Librechat as a PWA. This seems to be because the manifest is included as

<link rel="manifest" href="/manifest.webmanifest">

Which doesn't allow the browser to send cookies with the request. Manually adding a crossorigin field to allow cookies to be included in this request fixes this

<link rel="manifest" href="/manifest.webmanifest" crossorigin="use-credentials">

This doesn't seem to be as easy as I was hoping to fix with vite, but there is some prior art here: vitejs/vite#6648 - would be happy to try to contribute a fix if this method looks appropriate.

Steps to Reproduce

1. Host Librechat behind Cloudflare access (or any reverse proxy that needs auth)
2. Try to install PWA

What browsers are you seeing the problem on?

No response

Relevant log output

No response

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Thanks for looking into this.

I host my instance on cloudflare and have no issues with PWA but your settings might be more strict. There may also be a way to address this via backend.

PRs welcome.

[samvrlewis]

I host my instance on cloudflare and have no issues with PWA but your settings might be more strict. There may also be a way to address this via backend.

Are you behind Cloudflare access? I have my instance behind a cloudflare tunnel that's protected by cloudflare access - you need to login via Cloudflare before you can even hit it. I think this is what causes the issue - basically:

• Browser tries to go to /manifest.webmanifest, doesn't include any cookies (apparently manifests are treated as "credentialless" by default)
• Cloudflare 302s to redirect to login page as the request doesn't include the expected CF cookies
• CORS error

In any case I think this will fix, but happy for feedback on the approach: #5156