<874jhthjo0.fsf@esprit.tn>
Hello, Some time ago, a bug was brought to my attention about my curriculum vitae failing to open when its hyperlink is clicked [1]. I tried a number of things to work around the issue, but the only thing that worked was opening the link in a new tab. Note that the href attribute is set to a valid resource and devtools does not pick up on any sort of problems. At first, I thought it was a browser-specific issue (and so did this person [2] who's also hosting their website on sourcehut pages), but this bug affects just about every browser out there, mobile and desktop. 1. https://grtcdr.tn/contact.html 2. https://github.com/qutebrowser/qutebrowser/issues/7877 Thanks in advance, -- Aziz
<u3QSFixg4OD6kt3ZYzWinr1aI_BPg7_zXulStk1O7fM4YYlQEic3Xi76cWM6ZQTk8jxUF_D1rw3gqnr-gGslYEFnMWI_Utoo5_mOpHo_ajk=@emersion.fr>
<874jhthjo0.fsf@esprit.tn>
(view parent)
This is due to the "download" attribute on the link. It's rejected because pages.sr.ht's Content-Security-Policy has "sandbox" without "allow-downloads". See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
<87zfzlai3f.fsf@esprit.tn>
<u3QSFixg4OD6kt3ZYzWinr1aI_BPg7_zXulStk1O7fM4YYlQEic3Xi76cWM6ZQTk8jxUF_D1rw3gqnr-gGslYEFnMWI_Utoo5_mOpHo_ajk=@emersion.fr>
(view parent)
>>>>> Simon Ser writes: > This is due to the "download" attribute on the link. It's actually the same behavior with/without the "download" attribute. I've just removed it [1] so you can confirm. Well, almost the same behavior; devtools shows a "cv.pdf" resource being requested in the "Network" tab, yet it never loads. 1. https://git.sr.ht/~grtcdr/grtcdr.tn/commit/fbaf9edaf0f8ff11db091123aec14b6a1bdd8a58 -- Aziz
<hkm45FVparLFQstQ7haMp6JA1V_e9W4j355U4-g051oWB3RSm8H7j75i44UU7UdY3c_I6Ldxmh6AfgOsf6InaWW8AKG0H5t0_AfStKb17aY=@emersion.fr>
<87zfzlai3f.fsf@esprit.tn>
(view parent)
Works for me without the attr. Beware of the cache.
<87v8a9aheb.fsf@esprit.tn>
<hkm45FVparLFQstQ7haMp6JA1V_e9W4j355U4-g051oWB3RSm8H7j75i44UU7UdY3c_I6Ldxmh6AfgOsf6InaWW8AKG0H5t0_AfStKb17aY=@emersion.fr>
(view parent)
>>>>> Simon Ser writes: > Works for me without the attr. Beware of the cache. Oh, you were right, except now I'm starting to believe this indeed is browser-specific. I tried Firefox (desktop and mobile) and Epiphany, both loaded it fine. However, qutebrowser with cache disabled still failed to load the resource.