277416 2024-07-31 04:35:50 -0700 Using back/forward buttons with PDF, and a CSP without connect-src 'self' 2024-08-07 04:36:15 -0700 1 1 1 Unclassified WebKit PDF Safari 17 Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=166630 InRadar P2 Normal --- 1 craig+webkit webkit-unassigned a_protyasha simon.fraser thorton webkit-bug-importer wilander oldest_to_newest 2049794 0 craig+webkit 2024-07-31 04:35:50 -0700 If you follow a link to a PDF and it includes a Content-Security-Policy that does not allow connect-src 'self', then use the browsers back and forward buttons; when you go forwards (to view the PDF again) it won't render the PDF, it will show a grey window, and these errors in the dev tools console: [Error] Refused to connect to [URL] because it appears in neither the connect-src directive nor the default-src directive of the Content Security Policy. [Error] Failed to load resource: Blocked by Content Security Policy. (pdf, line 0) [Error] Refused to connect to [URL] because it appears in neither the connect-src directive nor the default-src directive of the Content Security Policy. [Error] Failed to load resource: Blocked by Content Security Policy. (pdf, line 0) [Error] Refused to connect to [URL] because it appears in neither the connect-src directive nor the default-src directive of the Content Security Policy. [Error] Failed to load resource: Blocked by Content Security Policy. (pdf, line 0) Example at: https://craig.dev/misc/safari/2024-07-21-pdf-connect/ 2051117 1 webkit-bug-importer 2024-08-07 04:36:15 -0700 <rdar://problem/133375947>