[GH-ISSUE #17044] feat: PDFs not rendering inside iframe/object due to sandbox restrictions #33679

Closed
opened 2026-04-25 07:34:37 -05:00 by GiteaMirror · 4 comments
Owner

Originally created by @agoston-huszka-wespeakai on GitHub (Aug 29, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/17044

Check Existing Issues

  • I have searched the existing issues and discussions.

Problem Description

I’m unable to render PDFs inline within OpenWebUI.

Using

Originally created by @agoston-huszka-wespeakai on GitHub (Aug 29, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/17044 ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description I’m unable to render PDFs inline within OpenWebUI. Using <object>: <object data="/static/exports/pdfs/example.pdf" type="application/pdf" width="800" height="600"></object> Error: Failed to load '<base_path>/static/exports/pdfs/example.pdf' as a plugin, because the frame into which the plugin is loading is sandboxed. Using <iframe>: <iframe src="/static/exports/pdfs/example.pdf" width="100%" height="600px"></iframe> Error: This page has been blocked by Chrome The file is accessible directly if I open /static/exports/pdfs/example.pdf in a new tab, so the PDF itself is fine — it just cannot be embedded in the UI. ### Desired Solution you'd like I’d like to be able to display PDFs inline in the artifacts/preview panel, either via <object> or <iframe>. Possible approaches: Adjusting the sandbox attributes on the iframe to allow PDF plugins. Ensuring headers like X-Frame-Options or Content-Security-Policy aren’t blocking inline PDF rendering. (Alternatively) providing an OpenWebUI-native way to embed PDFs (similar to SVG rendering). ### Alternatives Considered _No response_ ### Additional Context _No response_
Author
Owner

@rgaricano commented on GitHub (Aug 29, 2025):

userSettings/Interface/Artifacts - Check iframe sandbox options

<!-- gh-comment-id:3237687435 --> @rgaricano commented on GitHub (Aug 29, 2025): userSettings/Interface/Artifacts - Check iframe sandbox options
Author
Owner

@agoston-huszka-wespeakai commented on GitHub (Aug 29, 2025):

Thanks, I checked the suggested settings and both

iframe Sandbox Allow Same Origin
iframe Sandbox Allow Forms

are set to ON, but the issue remains the same — the PDF is still not rendering inside

<!-- gh-comment-id:3237706497 --> @agoston-huszka-wespeakai commented on GitHub (Aug 29, 2025): Thanks, I checked the suggested settings and both iframe Sandbox Allow Same Origin iframe Sandbox Allow Forms are set to ON, but the issue remains the same — the PDF is still not rendering inside <iframe> or <object>
Author
Owner

@rgaricano commented on GitHub (Aug 29, 2025):

I had some changes on my end regarding iframe rendering, I'll PR them briefly.

Right now, if you want to make it work with a quick fix:
Replace
https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte#L81
by

sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
        ? ' allow-forms'
        : ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}"

and rebuild

<!-- gh-comment-id:3237785865 --> @rgaricano commented on GitHub (Aug 29, 2025): I had some changes on my end regarding iframe rendering, I'll PR them briefly. Right now, if you want to make it work with a quick fix: Replace https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte#L81 by ``` sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false) ? ' allow-forms' : ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}" ``` and rebuild
Author
Owner

@tjbck commented on GitHub (Aug 31, 2025):

Intended behaviour due to security issue, we'll explore ways to display pdfs natively.

<!-- gh-comment-id:3239982851 --> @tjbck commented on GitHub (Aug 31, 2025): Intended behaviour due to security issue, we'll explore ways to display pdfs natively.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#33679