Resolving CSV/Excel download failures in Firefox for embedded Amazon QuickSight dashboards by allowing blob: in CSP

Symptom

• When you export a table visual to CSV or Excel in an embedded dashboard, the "Your CSV is ready." notification appears, but no file downloads.
• This happens only in Mozilla Firefox. The same dashboard downloads correctly in Chrome, Edge, and Safari, and it also works when you export directly from the QuickSight console.

Diagnosis

1. Reproduce the download in another browser (for example, Chrome) with the same embedded dashboard. If it works, you can narrow the cause to browser-specific behavior.
2. Export the same data directly from the QuickSight console. If it works, you can narrow the cause to the embedding (host application) layer.
3. Open the Firefox developer tools console and retry the download. Look for a CSP warning that names the blocked blob: resource and the violated CSP directive.
4. Check the full value of the Content-Security-Policy header applied to your host application.

Root cause

Amazon QuickSight embedding displays the dashboard in an iframe, so it's governed by the Content-Security-Policy (CSP) of the host application that wraps the dashboard. To use embedding, you must allowlist the QuickSight domains in your host application's CSP.

The CSV/Excel download from a table visual is delivered through a blob: URL that the browser generates on the client side. The "Your CSV is ready." message is the notification that QuickSight displays after it has successfully generated the export file. So, when you see this message, the file generation completed, and the problem is limited to the next step: the browser download.

Firefox blocks a download to a blob: URL inside an iframe (a nested browsing context) unless blob: is explicitly allowed in the CSP. Chrome, Edge, and Safari don't block the download in this scenario. Because Firefox is a supported browser for QuickSight, the download works correctly once you allow the required sources in your CSP.

Resolution

1. Add blob: to the frame-src directive of the CSP on the application that hosts the embedded dashboard. Replace <region> with the Region where you embed the dashboard, and list blob: and the QuickSight domain as separate, space-delimited sources.

   Content-Security-Policy: frame-src blob: https://<region>.quicksight.aws.amazon.com;
   

2. If frame-src isn't defined in your policy, the browser falls back to child-src, and then to default-src. So, if your policy controls frame loading through child-src or default-src instead of frame-src, add blob: to that directive as well. Adding blob: to the directive named in the Firefox console warning from diagnosis step 3 is the most reliable approach.

3. Apply the CSP as a Content-Security-Policy HTTP response header. Directives such as frame-src and child-src might not be enforced when the CSP is set through a <meta> tag.

Note: blob: is a scheme source, so you can't restrict it by origin (the origin of a blob: URL is null). Allowing blob: in a directive is therefore an all-or-nothing grant for that directive, so treat it as a security tradeoff based on your requirements. Also, a wildcard (*) in a host source applies only to subdomains, not to paths, so a form such as blob:https://.../* doesn't work. If you embed in multiple Regions, allowlist the QuickSight domain for every applicable Region.

Related information

• Supported browsers
• Prerequisites
• Content-Security-Policy: frame-src directive