8

When a website supplies a PDF there are two options for how a user might interact with it:

  • View it in browser
  • Download it

As the host of these files is there a security advantage one way or the other? Is it safer for the users if we default the functionality one way?

Improve this question
4
  • 2
    You can force a file to be downloaded but you cant force it to be viewed in a web browser
    – Purefan
    Commented Mar 8, 2017 at 13:58
  • 2
    I don't think either way puts you as the host at extra risk as it would just be the content stream that changes, you still host it. As a user I would expect slightly higher risk in moving a file to my machine rather than viewing it, either way the content does end up on your users's client.
    – iainpb
    Commented Mar 8, 2017 at 14:05
  • 1
    Just one precision, if you use CSP, it may prevent the view in the browser.
    – Tom
    Commented Mar 8, 2017 at 14:06
  • 1
    chrome uses an internal PDF renderer, which they upkeep, whereas adobe software is often dated.
    – dandavis
    Commented Mar 9, 2017 at 22:22

1 Answer 1

Reset to default
7

It's generally safer to force-download files, than to view them directly in the browser. However, in the case of PDFs, the PDF viewers in Firefox and Chrome are probably safer and more up-to-date than the ones from Adobe or Foxit

Assuming you let users upload PDFs:

  1. Store them in a database, and not on the file system, unless you know exactly what you're doing (see Path Traversal attacks)

  2. Serve them from a different domain name (like googleusercontent.com vs google.com), to avoid cookie theft/clobbering on your main domain

  3. Validate on upload. Check that size is the same as reported size. Check that filename looks ok. Virus scan. Use a PDF library to strip embedded JavaScript (you could try Apache PDFBox)

Improve this answer
1
  • thanks for sharing these useful security recommendations
    – pzirkind
    Commented Mar 9, 2017 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .