Blobs

Appears when the table has a {table}_blobs sidecar, written by document blobs.

Lists payloads without ever selecting the blob column — key, file name, content type, size and timestamps come from the metadata, so opening the tab on a table of 4 MB PDFs costs the same as opening it on a table of thumbnails. Filter by document id, which is what the Blobs link on a browse row does.

Preview renders images and text inline. Download streams over a plain HTTP endpoint rather than crossing the Blazor circuit as base64. Delete takes two clicks.

Serving other people’s bytes safely

Blob bytes come from whoever wrote the document, so serving them from our own origin is a real XSS surface. Two rules keep it closed:

• every response carries nosniff and a default-src 'none' CSP,
• anything not on the short raster-image allowlist is sent as an attachment rather than rendered.

SVG is excluded from inline display on purpose — it’s a document format that can carry script, not merely an image.