8

When a website supplies a PDF there are two options for how a user might interact with it:

  • View it in browser
  • Download it

As the host of these files is there a security advantage one way or the other? Is it safer for the users if we default the functionality one way?

  • 2
    You can force a file to be downloaded but you cant force it to be viewed in a web browser – Purefan Mar 8 '17 at 13:58
  • 2
    I don't think either way puts you as the host at extra risk as it would just be the content stream that changes, you still host it. As a user I would expect slightly higher risk in moving a file to my machine rather than viewing it, either way the content does end up on your users's client. – iainpb Mar 8 '17 at 14:05
  • 1
    Just one precision, if you use CSP, it may prevent the view in the browser. – Tom Mar 8 '17 at 14:06
  • 1
    chrome uses an internal PDF renderer, which they upkeep, whereas adobe software is often dated. – dandavis Mar 9 '17 at 22:22
7

It's generally safer to force-download files, than to view them directly in the browser. However, in the case of PDFs, the PDF viewers in Firefox and Chrome are probably safer and more up-to-date than the ones from Adobe or Foxit

Assuming you let users upload PDFs:

  1. Store them in a database, and not on the file system, unless you know exactly what you're doing (see Path Traversal attacks)

  2. Serve them from a different domain name (like googleusercontent.com vs google.com), to avoid cookie theft/clobbering on your main domain

  3. Validate on upload. Check that size is the same as reported size. Check that filename looks ok. Virus scan. Use a PDF library to strip embedded JavaScript (you could try Apache PDFBox)

  • thanks for sharing these useful security recommendations – pzirkind Mar 9 '17 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.