Replies: 1 comment
-
I figured it out. I am getting the cookies back and can verify it is logged in user. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Is there a way to have pdf.js return cookies when it fetches a pdf? In my WordPress plugin I am working on an alternative for pdf.js so that the url it uses is not a path to the pdf, but a request to my plugin with query strings. I'd like to confirm that the request is coming from a logged in user who has access to the pdf, but the request from pdf.js comes with no cookies so I am unable to see if the request is from a logged in user.
I am using the 3.11.174-dist.
I don't pass the actual path to pdf.js, and pdf.js I parse the received url to generate the actual path something like this:
let tempurl = src.url ? getUrlProp(src.url) : null;
if (tempurl.includes('dbtn-num')) {
tempurl = tempurl.replace('/coded-path/', '/wp-content/uploads/pdf-directory/');
} else {
// So the url passed in is invalid. Show the default page.
tempurl = 'https://mydomain/uploads/hj-direct/ViewerError.pdf'
}
const url = tempurl;
However, if a user uses developer tools and looks at the various headers, they will see the full path. I would rather they not be able to poke around and see the full path.
So I've had success with doing something like this:
safe_url = 'https://mydomain/wp-content/plugins/myplugin/viewer_download.pdf?dnld=pdf2get'
It's a little more complex as I pass by query strings with hashed tokens.
Inside viewer_download.pdf I can figure out the actual pdf to return, however pdf.js does not return the cookies so I can't do further checks to see what logged in user is requesting the pdf?
Beta Was this translation helpful? Give feedback.
All reactions