The worker checks who is asking for the file – For most files, it only lets requests come from your allowed websites (via Origin or Referer). PDFs are special: they bypass this so they can show in iframes.