On a Visualforce page I have an IFRAME like this:

<iframe class="viewer" src=""></iframe>

It starts up an shows nothing because src is blank. Good. To store the actual PDF I upload it as File (not the old Attachment). So technically I have a DocumentVersion which holds the blob of the pdf.

Now I use JS to update the src tag to show a PDF like this (where Id is set to a valid DocumentVersion id )


On the sandbox, it works like a charm: the pdf will be loaded inside the iframe as expected.

Now if I deploy the same code on Production, the following happens: the IFRAME is not updated, but the PDF is downloaded by the browser.

The code I use is 100% identical - but behaves differently !!

I found so far, that the code is NOT the reason for this. The difference is caused just by the link I use. This itself is behaving differently:

  • On sandbox, chrome is using the internal PDF-Viewer to display the file. Which is what I want.
  • On Production for a very short time (seconds only!) a new tab is opened and closed again and the PDF is downloaded instead of shown with the internal viewer.

I could not track it down, but I expect some headers are set differently by Salesforce causing that result.

Does anyone know more about the backgrounds on that or has encountered similar effects?


I was able to dig deeper inside this issue inspecting the headers in detail as shown here: Files: Why ContentVersion /sfc/servlet.shepherd/document/download/ sometimes sets Content-Disposition=attachment and sometimes =inline

Basic issue is, that Content-Disposition needs to be inline but on production it gets attachment.

  • any changes that VF security settings are different?
    – kurunve
    Commented Jul 3, 2017 at 10:10
  • Yes.. can be CSP in critical updates Commented Jul 3, 2017 at 10:29
  • @kurunve none I was able to find - I checked a lot but might have missed something. Any important thing I should double check?
    – Uwe Heim
    Commented Jul 3, 2017 at 12:47
  • @PranayJaiswal I've checked that this critical update is enabled on both (Sandbox and Production) and I still got the differences.
    – Uwe Heim
    Commented Jul 3, 2017 at 12:48
  • @UweHeim - were you able to get around this issue?
    – RedDevil
    Commented Jul 20, 2017 at 18:33

1 Answer 1


There is a specific settings in salesforce 'File Upload and Download Security' that can help you to choose download or show file.

enter image description here

There are 3 options of file download behavior:

  1. Download (recommended): The file, regardless of file type, is always downloaded.
  2. Execute in Browser: The file, regardless of file type, is displayed and executed automatically when accessed in a browser or through an HTTP request.
  3. Hybrid: Salesforce Files are downloaded. Attachments and documents execute in the browser.

Please reference this link for more invo: https://help.salesforce.com/articleView?id=admin_files_type_security.htm&type=5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .