On a Visualforce page I have an IFRAME like this:

<iframe class="viewer" src=""></iframe>

It starts up an shows nothing because src is blank. Good. To store the actual PDF I upload it as File (not the old Attachment). So technically I have a DocumentVersion which holds the blob of the pdf.

Now I use JS to update the src tag to show a PDF like this (where Id is set to a valid DocumentVersion id )


On the sandbox, it works like a charm: the pdf will be loaded inside the iframe as expected.

Now if I deploy the same code on Production, the following happens: the IFRAME is not updated, but the PDF is downloaded by the browser.

The code I use is 100% identical - but behaves differently !!

I found so far, that the code is NOT the reason for this. The difference is caused just by the link I use. This itself is behaving differently:

  • On sandbox, chrome is using the internal PDF-Viewer to display the file. Which is what I want.
  • On Production for a very short time (seconds only!) a new tab is opened and closed again and the PDF is downloaded instead of shown with the internal viewer.

I could not track it down, but I expect some headers are set differently by Salesforce causing that result.

Does anyone know more about the backgrounds on that or has encountered similar effects?


I was able to dig deeper inside this issue inspecting the headers in detail as shown here: Files: Why ContentVersion /sfc/servlet.shepherd/document/download/ sometimes sets Content-Disposition=attachment and sometimes =inline

Basic issue is, that Content-Disposition needs to be inline but on production it gets attachment.

  • any changes that VF security settings are different? – kurunve Jul 3 '17 at 10:10
  • Yes.. can be CSP in critical updates – Pranay Jaiswal Jul 3 '17 at 10:29
  • @kurunve none I was able to find - I checked a lot but might have missed something. Any important thing I should double check? – Uwe Heim Jul 3 '17 at 12:47
  • @PranayJaiswal I've checked that this critical update is enabled on both (Sandbox and Production) and I still got the differences. – Uwe Heim Jul 3 '17 at 12:48
  • @UweHeim - were you able to get around this issue? – RedDevil Jul 20 '17 at 18:33

There is a specific settings in salesforce 'File Upload and Download Security' that can help you to choose download or show file.

enter image description here

There are 3 options of file download behavior:

  1. Download (recommended): The file, regardless of file type, is always downloaded.
  2. Execute in Browser: The file, regardless of file type, is displayed and executed automatically when accessed in a browser or through an HTTP request.
  3. Hybrid: Salesforce Files are downloaded. Attachments and documents execute in the browser.

Please reference this link for more invo: https://help.salesforce.com/articleView?id=admin_files_type_security.htm&type=5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.