Get help on Discord

Hey, I am hosting a pdf on sanity and put it in a link on a webpage, recently I discovered that in safari it shows `Blocked plug-in` when clicking the link. This behavior...

6 replies
Last updated: Sep 28, 2020
Hey, I am hosting a pdf on sanity and put it in a link on a webpage, recently I discovered that in safari it shows 
Blocked plug-in
when clicking the link. This behavior is new to me and I do not have it with other pdf links. Does anyone have an idea why this is and what how to solve it? It is not just on my safari browser but as well on the one of my aunt (she’s the owner of the webpage I build and it already runs for almost 2 years now)
here is the part of my code:


{/*This was a test link where which works fine for me*/}
<a href="<https://blog.bernina.com/de/wp-content/uploads/sites/2/2016/07/Schnittmuster-A-kleid.pdf>" target="_blank" rel="noopener">Schnittmuster A-Kleid</a>
{/*This gives me the blocked plugin problem: */}
<a href="<https://cdn.sanity.io/files/m29pqcus/staging/d103fbd4191583b07c87301e18e1afd954e62348.pdf>" target="_blank" rel="noopener">Aktuelle Verhaltensregeln / Hygienemaßnahmen.</a>
Sep 27, 2020, 9:03 PM
Hi Sari, thanks for reporting this. It seems to be an issue with the Adobe plug-in and how plug-ins work in Safari in general, i.e. it’s not specific to your implementation, although that still doesn’t explain why it works with the other PDF in your code. Both links open the PDFs inside the browser, correct? And you’re not opening one of them in a separate tab but clicking both from within their own tab?

The latest versions of Safari use a new plug-in manager for enabling and disabling plug-ins on a global or per site basis. The Acrobat and Reader PDF viewer plug-ins are not trusted by default until you actively trust the plug-in globally, or for each website.
Sep 28, 2020, 8:53 AM
It seems be a common issue with some reports of it being resolved when people update Safari or Adobe Acrobat Reader, but other reports that it simply keeps showing the blocked plug-in warning.
I do see this in the console, which I’ll forward to the team just in case:

Refused to load <https://cdn.sanity.io/files/m29pqcus/staging/d103fbd4191583b07c87301e18e1afd954e62348.pdf> because it appears in neither the object-src directive nor the default-src directive of the Content Security Policy.
Sep 28, 2020, 2:47 PM
Shift-clicking the link to the PDF to open in new tab, or simply CMD+S to save it, should still work. It’s the preview that’s the issue in this case.
Sep 28, 2020, 2:49 PM
Also, you could try adding 
?dl
at the end of the URL to force a download instead of an in-line preview if that’s a workaround? 🙂
Sep 28, 2020, 3:04 PM
Actually, there was a recent change in our content security policy that might have been a little too strict here. This was fixed just now, but just to make sure the CDN is not serving the old CSP headers, one of our devs recommends adding 
?cache=break
temporarily:
<https://cdn.sanity.io/files/m29pqcus/staging/d103fbd4191583b07c87301e18e1afd954e62348.pdf?cache=break>
Sep 28, 2020, 3:26 PM
[Edited post above for extra context]
Sep 28, 2020, 3:29 PM

Sanity – Build the way you think, not the way your CMS thinks

Sanity is the developer-first content operating system that gives you complete control. Schema-as-code, GROQ queries, and real-time APIs mean no more workarounds or waiting for deployments. Free to start, scale as you grow.

Get started for freeExplore the demo

Was this answer helpful?