For example:
<iframe src="http://otherdomainidontcontrol.com/blah.csv"></iframe>
And blah.csv has this header:
Content-Disposition: attachment; filename=blah.csv;
Is it possible to force blah.csv to render in the iframe instead of downloading?
I don’t think there is a way to bypass Content-Disposition (and this is likely to be good for security reasons).