@m0sth8 is attempting to deploy a commit to the Umami Software Team on Vercel.

A member of the Team first needs to authorize it.

Greptile Summary

This PR adds crossorigin="use-credentials" to the <link rel="manifest"> tag so browsers include session cookies when fetching /site.webmanifest, fixing a CSP violation that occurs when Umami is deployed behind cookie-based auth proxies (AWS ALB OIDC, OAuth2 Proxy, Cloudflare Access, etc.).

• One-character change in src/app/layout.tsx: adds the crossorigin attribute to the manifest link so auth proxies receive the session cookie and serve the manifest correctly instead of redirecting to an identity provider.
• The attribute is spelled crossorigin (lowercase HTML form) rather than crossOrigin (the correct camelCase JSX prop name), which may produce a TypeScript compile error and should be corrected.

Confidence Score: 4/5

The fix is conceptually correct — adding credentials to the manifest fetch resolves the auth proxy CSP issue — but the attribute casing needs to be corrected before merging to avoid a potential build failure.

The only change is a single JSX attribute on the manifest link. The credential-inclusion behaviour is correct and safe for same-origin deployments. The issue is that crossorigin (lowercase) is not the recognised React/JSX spelling; crossOrigin (camelCase) is what LinkHTMLAttributes declares, so the build may fail on type-checking. Fixing the casing to crossOrigin makes this a clean, safe change.

src/app/layout.tsx — attribute casing needs to change from crossorigin to crossOrigin.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Browser
    participant AuthProxy as Auth Proxy (ALB/OAuth2)
    participant Umami

    Note over Browser,Umami: Before this PR (no credentials on manifest fetch)
    Browser->>AuthProxy: GET /site.webmanifest (no cookies)
    AuthProxy->>Browser: 302 → identity provider (e.g. accounts.google.com)
    Browser--xBrowser: CSP blocks cross-origin redirect

    Note over Browser,Umami: After this PR (crossOrigin="use-credentials")
    Browser->>AuthProxy: GET /site.webmanifest + session cookie
    AuthProxy->>Umami: Forwards authenticated request
    Umami->>Browser: 200 site.webmanifest

_{Reviews (1): Last reviewed commit: "Send credentials when fetching the web a..." | Re-trigger Greptile}