CSP for Google Docs Viewer: What to Allow and What to Avoid
If you’ve ever embedded a PDF, DOCX, or PPTX with Google Docs Viewer, you’ve probably hit the same wall everyone does: your Content Security Policy breaks it. That’s not a bug. That’s CSP doing its job. The annoying part is that Google Docs Viewer sits in an awkward middle ground. It’s convenient, familiar, and dead simple to drop into an <iframe>. But once you care about a tight CSP, third-party framing gets messy fast. You have to decide how much trust you want to hand to Google for a document-rendering feature that may not even be essential. ...