I'm attempting to render a PDF with the

AttachmentDisplay

component and am getting a CSP violation from the iframe that it renders.

Refused to frame 'https://storage.medplum.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors *.medplum.com"

Has the CSP been updated recently to include

frame-ancestors *.medplum.com

or has this always been the configuration? This prevents PDFs from being displayed with the

AttachmentDisplay

component

Hey @node thanks for bringing this to our attention. Nothing changed recently, but this might be a situation where certain it works on some OS/browser combos and not others. We're looking into it

Thanks for looking into this Rahul! If I'm not mistaken, with the CSP set on storage.medplum.com, any browser that respects CSP and supports

frame-ancestors

(which is most https://caniuse.com/?search=frame-ancestor) would break with

AttachmentDisplay

. Clients could wrap

AttachmentDisplay

to hook into pdf's and handle rendering the contents themselves without letting

AttachmentDisplay

attempt to render the PDF in an iframe until a path forward is landed on.

That's exactly right. The wrinkle is that if you have Adobe PDF reader installed, it might be bypassing CSP, which is why we didn't catch this earlier We just need to understand the security / compliance implications of relaxing CSP, vs. offering an alternative

Looks good - thank you for the support and quick resolve!