Replies: 1 comment
-
I figured it out. I am getting the cookies back and can verify it is logged in user. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Is there a way to have pdf.js return cookies when it fetches a pdf? In my WordPress plugin I am working on an alternative for pdf.js so that the url it uses is not a path to the pdf, but a request to my plugin with query strings. I'd like to confirm that the request is coming from a logged in user who has access to the pdf, but the request from pdf.js comes with no cookies so I am unable to see if the request is from a logged in user.
I am using the 3.11.174-dist.
I don't pass the actual path to pdf.js, and pdf.js I parse the received url to generate the actual path something like this:
let tempurl = src.url ? getUrlProp(src.url) : null;
if (tempurl.includes('dbtn-num')) {
tempurl = tempurl.replace('/coded-path/', '/wp-content/uploads/pdf-directory/');
} else {
// So the url passed in is invalid. Show the default page.
tempurl = 'https://mydomain/uploads/hj-direct/ViewerError.pdf'
}
const url = tempurl;
However, if a user uses developer tools and looks at the various headers, they will see the full path. I would rather they not be able to poke around and see the full path.
So I've had success with doing something like this:
safe_url = 'https://mydomain/wp-content/plugins/myplugin/viewer_download.pdf?dnld=pdf2get'
It's a little more complex as I pass by query strings with hashed tokens.
Inside viewer_download.pdf I can figure out the actual pdf to return, however pdf.js does not return the cookies so I can't do further checks to see what logged in user is requesting the pdf?
Beta Was this translation helpful? Give feedback.
All reactions