Provide option to set HOSTED_VIEWER_ORIGINS configuration for PDF.js

Created on 29 July 2019, almost 6 years ago

Updated 8 May 2025, 7 days ago

There appear to be two cases where PDF.js will not display a PDF because of mismatched hostnames.

Case 1: When using eg Remote Stream Wrapper to add remote PDF files to the media library. PDF.js refuses to display these files, as the origin of the file doesn't match that of viewer.js.
Case 2: When the hostname of the viewed page and the hostname of the embedded viewer differ (eg when viewing a PDF via https://admin.example.org, and viewer.html is linked to on https://www.example.org, eg a site using CloudFlare on the www hostname and with admin exposed via the admin hostname. The error message for this is Message: file origin does not match viewer's, displayed in the PDF.js iframe.

There's a variable in PDF.js, HOSTED_VIEWER_ORIGINS, intended to allow for adding additional valid origins:

var HOSTED_VIEWER_ORIGINS = ['null', 'http://mozilla.github.io', 'https://mozilla.github.io', 'https://yourdomain.org'];

I'm not sure if this is possible, but could this variable be modified by the module, so that additional valid origins could be configured using the module?

✨ Feature request

Status

Postponed

Version

1.0

Component

Code

Created by

🇺🇸United States wrd

Live updates comments and jobs are added and updated live.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment 7 days ago →
🇳🇿New Zealand xurizaemon Ōtepoti, Aotearoa 🏝
We observed issue with PDFs embedded on the "main" (www.example.org) URL when viewed from an admin-specific URL (eg admin.example.org, if you were viewing from a separate admin URL for use cases such as CloudFlare). The error message displayed was "Message: file origin does not match viewer's". I've added this to the issue description as Case 2.

Patch 10 from 🐛 Behind HTTPS Load Balancer, Renders HTTP load of JS to Browser Needs work makes the viewer JS a relative URL, removing the hostname. For some folks running into this issue, that may be enough to solve the display problem.

However, it seems like that patch won't address Case 1 in this issue description (remote PDF, via remote stream wrapper, on a different host to the viewed page).
Comment 7 days ago →
🇳🇿New Zealand xurizaemon Ōtepoti, Aotearoa 🏝
removing assignment from 2019

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024