About Web app manifest files
The manifest linked with <link rel="manifest"> gives an installable web app its name, icons, colours and start URL. Browsers also accept it as application/json or with a .json extension, so the type rarely causes problems; a wrong icon path or missing icon size is the more common reason an app isn’t installable.
File signature
WEBMANIFEST has no fixed signature: it is data without a magic number, so validate uploads by parsing the content rather than by checking bytes.
Serve .webmanifest with the right Content-Type
Content-Type: application/manifest+json
application/manifest+json webmanifest;
AddType application/manifest+json .webmanifest
@webmanifest path *.webmanifest
header @webmanifest Content-Type "application/manifest+json"
curl -sI https://example.com/file.webmanifest | grep -i '^content-type'
# Content-Type: application/manifest+json
Set the type in code
res.set('Content-Type', 'application/manifest+json');
import mimetypes
mimetypes.add_type('application/manifest+json', '.webmanifest') # if your system doesn't know it
mimetypes.guess_type('file.webmanifest')[0] # 'application/manifest+json'
mime.AddExtensionType(".webmanifest", "application/manifest+json")
w.Header().Set("Content-Type", "application/manifest+json")
Accept .webmanifest uploads
<input type="file" accept=".webmanifest,application/manifest+json">
The accept attribute only filters the file picker; users can still choose another file. Listing the
extension as well as the type matters, because operating systems don’t always report the type you expect.
Related types
More web
.css , .js , .mjs , .svg , .wasm , .rss , .vtt . Look up any extension or type with the MIME type lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is the MIME type for .webmanifest files?
application/manifest+json. The full header is "Content-Type: application/manifest+json".
Why does my server send the wrong Content-Type for .webmanifest?
Web servers pick the type from the file extension using a table (mime.types in nginx and Apache). If .webmanifest is missing from that table, they send a default such as application/octet-stream or text/plain. Add the mapping as shown on this page, then check the response with "curl -sI".
How can I check that a file really is WEBMANIFEST?
WEBMANIFEST has no fixed file signature, so the extension and content are all you have. Check that the content is what you expect, for example by parsing it, before trusting an upload.