[Bug]: MP4 files fail to play in Files viewer when CSP blocks blob: media URLs #66007

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

When I open an MP4 file in the Files app, the viewer does not load or play it. The browser console reports that the video’s blob: URL is blocked by the Content Security Policy.

Steps to reproduce

1. Open the Files app in Firefox.
2. Open an MP4 file in the viewer.
3. Observe that the video does not load.

Expected behavior

The MP4 should load and play in the Files viewer.

Actual behavior

The viewer falls back to fetching the file, then attempts to use a blob: URL that Firefox blocks because the page’s CSP restricts media to 'self'. The preview service worker is also blocked because no worker-src directive is present and the policy falls back to script-src.

A request to the instance root returned a different CSP (media-src *), while the authenticated Files page returned the policy shown above. This may be relevant if CSP headers differ by route.

Could you confirm whether this is expected behavior or a regression, and whether the Files/Viewer app should support MP4 playback under this CSP?

Nextcloud Server version

35

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "serverid": "0",
        "trusted_domains": [
            "<instance>"
        ],
        "overwrite.cli.url": "<instance>",
        "dbtype": "mysql",
        "version": "35.0.2.2",
        "mysql.utf8mb4": true,
        "logtimezone": "Europe\/Berlin",
        "default_language": "de",
        "force_language": "de",
        "default_locale": "de",
        "default_phone_region": "DE",
        "installed": true,
        "filelocking.enabled": false,
        "integrity.check.disabled": true,
        "mail_smtpmode": "smtp",
        "loglevel": 3,
        "maintenance": false,
        "htaccess.RewriteBase": "\/",
        "theme": "",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpport": "465",
        "mail_smtpauth": true,
        "mail_sendmailmode": "smtp",
        "encryption.legacy_format_support": false,
        "encryption.key_storage_migrated": false,
        "versions_retention_obligation": "auto, 30",
        "trashbin_retention_obligation": "auto, 30",
        "defaultapp": "",
        "maintenance_window_start": 1,
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "app_install_overwrite": []
    }
}

List of activated Apps

- app_api: 35.0.0
  - appstore: 2.0.0
  - bruteforcesettings: 8.0.0
  - calendar: 6.6.4
  - cloud_federation_api: 2.0.0
  - comments: 2.0.0
  - contacts: 8.9.2
  - contactsinteraction: 2.0.0
  - dashboard: 8.0.0
  - dav: 2.0.0
  - deck: 1.19.1
  - encryption: 3.0.1
  - federatedfilesharing: 2.0.0
  - federation: 2.0.0
  - files: 3.0.0
  - files_downloadlimit: 5.3.0
  - files_mindmap: 0.1.5
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0
  - files_sharing: 2.0.0
  - files_trashbin: 2.0.0
  - files_versions: 2.0.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0
  - notes: 6.1.0
  - notifications: 8.0.1
  - oauth2: 2.0.0
  - password_policy: 7.0.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0
  - provisioning_api: 2.0.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0
  - sharebymail: 2.0.0
  - sharing: 1.0.4
  - tasks: 0.18.1
  - text: 9.0.1
  - theming: 3.0.0
  - theming_customcss: 1.22.0
  - twofactor_backupcodes: 2.0.0
  - updatenotification: 2.0.0
  - user_status: 2.0.0
  - viewer: 8.0.0
  - webhook_listeners: 2.0.0
  - workflowengine: 3.0.0

Nextcloud Signing status

Nextcloud Logs

Additional info

Relevant console messages:
[ERROR] files: SW registration failed: DOMException

Content-Security-Policy: The page's settings blocked the loading of a worker
(script-src) at https:///index.php/apps/files/preview-service-worker.js
because it violates the following directive:
"script-src 'nonce-…'"

Loading of file /.mp4 failed, falling back to fetching it by hand

Content-Security-Policy: The page's settings blocked the loading of a resource
(media-src) at blob:https:/// because it violates the
following directive: "media-src 'self'"

The authenticated Files page returns this CSP (nonce omitted):

default-src 'none';
base-uri 'none';
manifest-src 'self';
script-src 'nonce-…';
script-src-elem 'strict-dynamic' 'nonce-…';
style-src 'self' 'unsafe-inline';
img-src 'self' data: blob: https://*.tile.openstreetmap.org;
font-src 'self' data:;
connect-src 'self';
media-src 'self';
frame-src 'self' data:;
frame-ancestors 'self';
form-action 'self'