3

I am working on a project that uses a Java Backend Application that hosts a PDF over a REST interface. Up to Chrome 87 and in Firefox this works perfectly fine. Since Chrome 88, however, I get this error: Chrome error message

Chrome Version: 88.0.4324.150 (Official Build) (64-bit)

I already tried:

  • Disabling all browser extensions
  • Setting a real filename for the PDF so it is hosted as /medias/sample.pdf?context=…
  • Checking the Chrome release notes. The “Insecure downloads are blocked from secure pages, with changes through Chrome 88” sounds suspicious, but then the PDF would have been blocked already in Chrome 87

Does anyone have the same problem or a hint on what the problem could be?

I can't post the link to the PDF itself, these are the Request and Response headers, though: enter image description here enter image description here

1 Answer 1

1

It seems like it is coming from csp sandbox header. I assume that chrome had some bug until now and it was fixed by this release, because by default pdf extension should be blocked by this header according to spec: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox

Pretty sure that it will be fixed if you remove sandbox mode for csp. You could also report an issue to chrome, to ask them whether this is expected behavior or some regression

6
  • That was indeed the problem, thank you! It is quite strange, however, that in Firefox viewing the PDF works with the header set to sandbox. Maybe it really is a bug in Chrome, I will open a ticket there.
    – Armin
    Feb 18, 2021 at 14:33
  • Do you know why I still have ERR_BLOCKED_BY_CLIENT error even without sandbox header? it is just happening on recent chrome 89
    – CallMeLaNN
    Mar 19, 2021 at 11:02
  • @CallMeLaNN, i'm also having this problem. Did you manage to find a fix for this? It only happens when i redirect to but if enter it in url, it somehow works. But in my case, i don't have a sandbox csp header Sep 10, 2021 at 7:24
  • @The.Wolfgang.Grimmer did you find a fix for this? I am stuck on the same issue and it works if I just paste the URL
    – noor
    Sep 29, 2021 at 18:33
  • same here, @The.Wolfgang.Grimmer would be very happy to learn about a fix or workaround Oct 7, 2021 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.