I forgot to add, like others mentioned this does not protect the content rather it just blocks normal browsers from rendering it for the viewer. If that is you

I forgot to add, like others mentioned this does not protect the content rather it just blocks normal browsers from rendering it for the viewer. If that is your only goal then replacing what the viewer sees should suffice. If the goal is to protect content then the payload would need to be encrypted and the authorized viewers would need the key or password to decrypt the blob however part of this transaction is client side. Perhaps you could elaborate more around the use cases.