PDF hosted over REST interface returns ERR_BLOCKED_BY_CLIENT in Chrome 88+

user_2220292 0
Viewed 1552

I am working on a project that uses a Java Backend Application that hosts a PDF over a REST interface. Up to Chrome 87 and in Firefox this works perfectly fine. Since Chrome 88, however, I get this error: Chrome error message

Chrome Version: 88.0.4324.150 (Official Build) (64-bit)

I already tried:

  • Disabling all browser extensions
  • Setting a real filename for the PDF so it is hosted as /medias/sample.pdf?context=…
  • Checking the Chrome release notes. The “Insecure downloads are blocked from secure pages, with changes through Chrome 88” sounds suspicious, but then the PDF would have been blocked already in Chrome 87

Does anyone have the same problem or a hint on what the problem could be?

I can't post the link to the PDF itself, these are the Request and Response headers, though: enter image description here enter image description here

google-chrome pdf
1 Answers

It seems like it is coming from csp sandbox header. I assume that chrome had some bug until now and it was fixed by this release, because by default pdf extension should be blocked by this header according to spec: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox

Pretty sure that it will be fixed if you remove sandbox mode for csp. You could also report an issue to chrome, to ask them whether this is expected behavior or some regression

user_152224560
Related