Hiding the location of the pdf you want to show in pdf.js.

[BowFarmer]

I'm sure this is an issue that many who use pdf.js viewer in their website have. How to have pdf.js display a pdf but keep the url of the pdf hidden.

It was a problem I had on my Wordpress site. I discovered that it wasn't that difficult using browser tools to discover the full path to any pdf I had pdf.js display.

I have no idea if this is a good solution or not, but what I do is modify function getDocument(src = {}) in my version of pdf.mjs.

Pdf.mjs sets the url of the pdf to src.url ? getUrlProp(src.url) : null;

What I do is set a window property in my view.php which builds the viewer html:

<script type="text/javascript">
	window.pdfurl = <?php echo wp_json_encode( $pdf_url ); ?>;
</script>

The variable $pdf_url is a url with query strings including one with the encrypted path to the pdf. The url looks like this:

https://mydomain/pdfs-read-online?read_now=1&_wn=7f0fee7099&z=52&zti=1722884377&ep=r2Iy1kcY1q7NBO0nELMXDENTT1NhZ0RwNHBrT09DSDZUOEV2SitjalRaV0N5dmdiSnhwVzRhYldrZFprdU81R1FmN2RoMFpDYlZjOUZnVytIY1cxUlFJMkdzNWhsY3ZFbjFpd2RBPT0%3D

window.pdfurl now contains a url with the encrypted path to a pdf.

Pdf.mjs will automatically have access to any window.property.

Inside my version of pdf.mjs I modify function getDocument to set the url like this.

const url = window.pdfurl;

My pdf.mjs queries that url to get the pdf. My Wordpress plugin takes that url, decodes the encrypted file path, and using the query strings in the url, makes sure the logged in user is authorized to read it, makes sure that the url is not older than 5 minutes, and hands over the pdf to nginx using X-Accel-Redirect. Nginx sends the pdf to pdf.mjs, and moments later, my pdf.mjs displays the pdf and the path to that pdf is hidden. The only url users can see in browser development tools is that incomprehensible url with the encrypted path.

It's a simple fix, and I am able to quickly make the change to pdf.mjs when a new release of pdf.js is released. It takes maybe 20 minutes to process a new legacy release and test it, before I have the new release running on my Wordpress site. And the location of pdfs I display in the viewer remain hidden.