### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [November 11, 2025, 9:39pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/1 "2025-11-11T21:39:03Z")
Currently, the core handling of PDFs is via a download:
[allaboutcats.pdf](https://meta.discourse.org/uploads/short-url/kc7PBLn0YWV50qV2erkiGh7Frkb.pdf) (42.2 KB)
While this is very functional, it adds a couple of unnecessary steps for the most common use case: “I want to read this now” - especially on mobile devices.
The need to download / save something is very much secondary. Required sometimes, but usually the user just wants to read it and then move on.
The [Inline PDF Previews](https://meta.discourse.org/t/inline-pdf-previews/157649) TC addresses this by serving an inline PDF on desktop - and does this with aplomb. However, it misses these common situations:
1. PDFs on mobile devices
2. Multiple PDFs (due to visual clutter)
3. Viewing PDFs in a full browser tab
Of note, there are other paths to downloading a PDF. They can be downloaded from a link directly (via right-click / context menu), or from within the browser-based PDF viewer that this TC serves.
## Suggestion: open PDFs in browser by default
This little tweak solves both of these situations nicely, and simply key into the default behaviour for other links in Discourse. So with the proposed change:
1. PDF links in mobile typically open in the same browser window
- enables single tap viewing
2. PDF links on desktop (i.e. above the inline PDF) open in a new tab
- this allows one-click full tab viewing
3. When inline behaviour is deliberately suppressed (by adding a space in the link text)
- allows one-click viewing
I’ve wrapped these up into this PR:
>
>
> This markedly improves the UX for people accessing PDFs - especially from mobile….
>
> In mobile, the browser will render the PDF in a new tab (instead of the core default forced download). This reduces a multi-step process to a single tap.
>
> On desktop with Inline mode, the link will also open in a new tab, enabling a fullscreen view; the existing download behaviour was redundant, as it is included in native browser PDF viewers. Full tab is not available from within an iFrame, so this is useful additional functionality.
>
> Desktop New tab mode is unchanged.
>
> Also addressed deprecation notices related to mobile view checking.
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [November 12, 2025, 2:55pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/2 "2025-11-12T14:55:14Z")
Can anyone of your team maybe have a look at this PR @david ?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [November 12, 2025, 4:01pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/4 "2025-11-12T16:01:04Z")
I left some comments about the code itself on the PR
> [@nathank](#):
>
> Currently, the core handling of PDFs is via a download:
When I click this link, it opens the PDF in the browser. No download. Are you seeing something different?
I’m using Chrome on macOS. We’re not running this `d-pdf-previews` theme component on Meta.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [December 1, 2025, 4:00am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/5 "2025-12-01T04:00:41Z")
> [@david](#):
>
> When I click this link, it opens the PDF in the browser. No download. Are you seeing something different?
Here in [meta.discourse.org](http://meta.discourse.org), my link above opens in the same tab as this page (just like you describe). This is unchanged in `safe-mode`.
However, on three of my recently updated sites (with the TC disabled) it attempts a download. This is also the case with `safe-mode`. I’m not sure why that is. I can’t see any site settings that govern this at all.
Whatever the reason, my fork fixes it for my sites nicely!
This makes no sense to me!!
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 1, 2025, 12:53pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/7 "2025-12-01T12:53:55Z")
I’m going to see if we can get this inconsistency fixed up in core. Will update here with progress.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [January 14, 2026, 10:44pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/9 "2026-01-14T22:44:57Z")
Any joy with this thusfar?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [January 14, 2026, 10:51pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/10 "2026-01-14T22:51:06Z")
We do have a work-in-progress. Hopefully will be able to land it in the next couple of weeks. It’s a little tricky because there are lots of different situations to verify (local uploads, s3, s3-compatible, with cdn, without cdn, etc).
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 15, 2026, 4:37pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/11 "2026-01-15T16:37:13Z")
I just checked a PDF that I uploaded to a topic today on a recently updated site and clicking the pdf link opens the PDF url on the CDN in my browser, fwiw
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 6, 2026, 5:17pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/12 "2026-02-06T17:17:14Z")
This should be resolved since [SECURITY: Download allowlist for uploaded files · discourse/discourse@9c0642a · GitHub](https://github.com/discourse/discourse/commit/9c0642a2e79040a140b99601296cb10cf425eb9f)
We now have centralised logic to determine which files should be shown ‘inline’. That means that PDFs are consistently shown inline, and some less safe file types are consistently served as downloads. These changes should work on all types of upload storage (local & S3, with or without CDNs).
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 16, 2026, 8:00am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/13 "2026-02-16T08:00:46Z")
This topic was automatically closed after 9 days. New replies are no longer allowed.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [February 17, 2026, 2:36am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/14 "2026-02-17T02:36:13Z")
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [February 17, 2026, 2:40am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/15 "2026-02-17T02:40:55Z")
David, I’ve just tested this - and while this definitely seems fixed on desktop, it doesn’t seem to be the case for mobile.
When I click on a PDF link in mobile, I get download (which I don’t want). I want it opening in the browser directly (i.e. the same as desktop), regardless of whether the TC is installed or not.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 17, 2026, 7:44am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/16 "2026-02-17T07:44:49Z")
Can you expand on your setup (S3? CDN?), and your mobile device OS?
Clicking the pdf in the OP here on my iPhone seems to open inline correctly.
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [February 17, 2026, 9:32am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/17 "2026-02-17T09:32:22Z")
> [@david](#):
>
> We now have centralised logic to determine which files should be shown ‘inline’. That means that PDFs are consistently shown inline, and some less safe file types are consistently served as downloads.
What about mp4 files? On most of websites, links to mp4 naturally plays them in the browser, but not in discourse, which is rather annoying 🙂
Example: [https://unicyclist.com/uploads/default/original/3X/4/f/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4](https://unicyclist.com/uploads/default/original/3X/4/f/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4)
Expected behavior: [https://d.canapin.dev/uploads/default/original/2X/4/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4](https://d.canapin.dev/uploads/default/original/2X/4/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4)
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 17, 2026, 9:43am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/18 "2026-02-17T09:43:42Z")
In theory, mp4 should be served inline:
>
which uses:
>
> [@Canapin](#):
>
> Expected behavior: [https://d.canapin.dev/uploads/default/original/2X/4/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4](https://d.canapin.dev/uploads/default/original/2X/4/4fb882b8ca5a0b0e3d75ff932506d57325f5582c.mp4)
How did you achieve this? i.e. what’s the difference from [unicyclist.com](http://unicyclist.com)?
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [February 17, 2026, 9:45am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/19 "2026-02-17T09:45:04Z")
Sorry I should have mentioned the distinction. The latter uses a plugin: [Discourse Video Inline](https://meta.discourse.org/t/discourse-video-inline/394334)
On meta, discourse forces mp4 downloads as well: [https://global.discourse-cdn.com/meta/original/4X/3/f/0/3f09f895d21cf0ae897d90c947abb816830b00a2.mp4](https://global.discourse-cdn.com/meta/original/4X/3/f/0/3f09f895d21cf0ae897d90c947abb816830b00a2.mp4)
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [February 18, 2026, 4:15am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/21 "2026-02-18T04:15:48Z")
> [@david](#):
>
> Can you expand on your setup (S3? CDN?), and your mobile device OS?
It has changed!!! I’ve just updated again today, and they are opening inline on mobile just fine.
Did you tweak something for us ‘simple self-hosters (no CDN/S3)’? Or was this some dumb caching thing?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 18, 2026, 7:36am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/22 "2026-02-18T07:36:57Z")
No tweaks since the security fix linked above. It could’ve been caching, especially if you did the upgrade via the UI the first time. If you’ve now done a full rebuild, then that will’ve reset the NGINX cache. Glad to hear it’s working now!
I opened a new topic for the mp4 issue
> [@Mp4 files are downloading instead of displaying inline](https://meta.discourse.org/t/mp4-files-are-downloading-instead-of-displaying-inline/396363):
>
> Continuing the discussion from [Make PDFs open directly (not via download) by default](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/21) Something is causing mp4 files to still be served with content-disposition: attachment. We need to investigate and fix.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [February 21, 2026, 8:00am UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/23 "2026-02-21T08:00:08Z")
This topic was automatically closed after 3 days. New replies are no longer allowed.