PDF files as links doesn't show on chromium

[olmari]

Relates closely to element-hq/element-web#8605

No matter what CSP I give on reverse-proxy, a PDF file tried to download as link with chromium based browsers still hits the wall. This is especially problem on those bridge users who has no other option than receive file as link.

Synapse 1.5.1 from matrixorg debian repo

[olmari]

I just learned that synapse gives own CSP header anyways, and that to circumvent that I needed to give proxy_hide_header Content-Security-Policy; onto media endpoint nginx RP section, and then give our own CSP header that allows PDF's to flow through...

So while I now know how to circumvent overzealous CSP header from synapse, this is sitll valid point that synapse shouldn't be the arbitrator of users not getting a PDF at all, but should allow PDF link to work on modern browsers too at least somehow if not allowing blindly all CSP insecuruties.

[varesa]

matrix-org/matrix-react-sdk#2847 fixes this by forcing the browser to download the PDF instead of showing it with a built-in viewer. However this only affects users of riot-web and other web clients based on the library. It would be cleaner to handle it on synapse side.

It is possible to tell the browser to download the file instead of opening it with either the Content-Disposition or Content-Type headers

Content-Disposition: attachment directly instructs the browser that the file should not be viewed automatically. https://www.w3.org/Protocols/HTTP/Issues/content-disposition.txt

Content-Type: application/octet-stream can also be used to hide the actual content of the file which disables automatic logic like opening a PDF viewer on application/pdf. The type application/octet-stream is (generally) just downloaded.

On a private homeserver these can be set using for example nginx as a reverse proxy as follows:

proxy_hide_header Content-XXX;
add_header Content-XXX: "yyy";

However this won't help for example those on Freenode IRC channels which are bridged to Matrix by the official bridge which serves media from the matrix.org homeserver. Currently sharing files from Matrix to Freenode is partly broken for those who are using Chrome / Chromium-based browsers (apparently ~70% of browsers)

[DMRobertson]

Apparently https://github.com/matrix-org/synapse/pull/4284/files was the underlying Synapse change.