Both of them use a quirky mechanism in which they fetch in the background via JS (with Authorization header applied), then create local blobs in which to serve the items. Preview gets blocked entirely in Safari due to being a popup. Ideally these things should be served as normal looking, bookmarkable GETs on the attached file. That isn't feasible currently because of the need for the Authorization header. Maybe post-event somehow (cookies?).
Both of them use a quirky mechanism in which they
fetchin the background via JS (with Authorization header applied), then create local blobs in which to serve the items. Preview gets blocked entirely in Safari due to being a popup. Ideally these things should be served as normal looking, bookmarkable GETs on the attached file. That isn't feasible currently because of the need for the Authorization header. Maybe post-event somehow (cookies?).