Content blocked when using iframe with hardcoded base64 string

[enpro-github]

I am trying to embed a base64 string inside of an iframe and display it in an app but I keep receiving the message showing that the content is blocked and to contact the owner. I modified CORS setting in the nginx server serving by budibase instance (self-hosted), but to no avail. I'm not even sure why this would involve CORS since I'm not requesting resources from another origin? The encode image is hardcoded into a variable.

Here is the code I'm using for the embedded iframe:

var pdfBase64String = '<encoded string>'

var dataUri = "data:application/pdf;base64," + pdfBase64String;

// Create iframe attributes
var src = 'src="' + dataUri + '"';
var width = 'width="100%"';
var height = 'height="790px"';
var frameBorder = 'frameborder="0"';
var style = 'style="border: 0;"';

var iframe = '<iframe ' + src + ' ' + width + ' ' + height + ' ' + frameBorder + ' ' + style + '></iframe>';

// Return the iframe HTML
return iframe;

My nginx conf:

server {
    listen 443 ssl;

    server_name ****;
    ssl_certificate     ***;
    ssl_certificate_key ***;
    client_max_body_size 100M;

        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_pass http://bbproxy:10000/;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

                if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' '*';
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
                #
                # Custom headers and headers various browsers *should* be OK with but aren't
                #
                add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
                #
                # Tell client that this pre-flight info is valid for 20 days
                #
                add_header 'Access-Control-Max-Age' 1728000;
                add_header 'Content-Type' 'text/plain; charset=utf-8';
                add_header 'Content-Length' 0;
                return 204;
                }
                
                if ($request_method = 'POST') {
                    add_header 'Access-Control-Allow-Origin' '*' always;
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
                    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
                }
                if ($request_method = 'GET') {
                    add_header 'Access-Control-Allow-Origin' '*' always;
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
                    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
                }
                    }


            #root var/www/html;
            index index.php  index.html index.htm;
}

Thank you in advance for your help

[enpro-github]

It looks like it's not CORS, I'm able to embed base64 images just fine. But base64 PDFs are an issue