I’m working on a web application where I need to display file previews in an iframe. The files are served with a Content-Type of application/octet-stream, but instead of previewing the content, the browser downloads the file.

I’ve tried using the sandbox attribute with different configurations, but when I add sandbox="allow-scripts allow-same-origin", Chrome blocks the content, even if the file is a PDF (with application/pdf).

Here’s my current code:

<div class="side-panel__content">
    <iframe class="w-full h-full" src="@_filePreviewUrl" sandbox="allow-scripts allow-same-origin">
    </iframe>
</div>

Issue 1: When the file’s Content-Type is application/octet-stream, the browser downloads the file instead of showing a preview.
Issue 2: When I add the sandbox attribute, Chrome blocks the content even if the file is application/pdf.
Question: Is there any way to force the iframe to render the content inside the browser, even when the file’s content type is application/octet-stream? Are there any configurations or workarounds to handle both the sandboxing and content type issues?