File Downloads from the Home Directory Fail Only in Safari (version 4.2.3)

Get Help
1

Dear developers,

I installed the latest version of OOD 4.2.3, and noticed that file downloads from the Home Directory fail only in Mac Safari. The following message appears in the Safari console:

Refused to load .../pun/sys/dashboard/files/fs/...?download=... because it does not appear in the frame-ancestors directive of the Content Security Policy.

The same files can be downloaded successfully using Mac Chrome and Firefox. Other operations in Safari, such as renaming and uploading files, also appear to work correctly.

Has anyone encountered this issue?

Thanks,

2

Could you share the device and Safari versions you are seeing this on? After some cursory research it looks like Safari can have some strange quirks with enforcing CSPs compared to the other browsers, but I am able to download just fine from OSC production running OOD 4.2.3, with Safari Version 26.5 (20624.2.5.18.3), on an M2 Mac running MacOS Sequoia 15.7.4.

My hunch is that this either has to do with a precise bug with your Safari version, or it is a generic Safari bug only getting hit because of your configuration of the security_csp_frame_ancestors value in ood_portal. I’d be happy to compare whatever you can share about this config with what we use at OSC!

3

@bsingleton
Thanks for looking into this. Here are the details of my environment:

  • MacBook Air with an M5 chip
  • macOS Tahoe 26.5.2
  • Safari 26.5.2 (21624.2.5.11.8)

Thanks,

4

Mmmm, I was able to update to your specific patch version of Safari but still was unable to replicate. There are a few things I have thought of for troubleshooting though. First, the frame-ancestor policy should affect all the iframe elements equally. Do you experience the same issue with grafana or XdMod panels in your instance?

Second, could you share the actual header that is sent by inspecting the page? It would be part of the response headers of the first item in the network tab. You may need to reload the page with the network tab open to collect this data. For example, mine looks like

image
image1344×1245 250 KB

5

Thank you for checking.

I have embedded Google Calendar in the dashboard using an iframe, and it works correctly. I have also attached the response headers.

Screenshot 2026-07-14 at 9.28.31
Screenshot 2026-07-14 at 9.28.312968×1172 497 KB

I apologize for providing the information piecemeal, but the OOD server is behind a load balancer. The load balancer’s FQDN is ondemand.fugaku.r-ccs.riken.jp, while the server’s actual hostname is ondemand2.fugaku.r-ccs.riken.jp. In ood_portal.yml, I use ondemand.fugaku.r-ccs.riken.jp for servername.

I then added 'ondemand2.fugaku.r-ccs.riken.jp' to security_csp_frame_ancestors in ood_portal.yml, and confirmed that this resolved the issue.

Thank you very much for your help.