Question

Is there a way or a service that allows for read-only (no saving or downloading) PDF embeds on one domain only? I know that there are services like Scribd and Slideshare but the problem is that while they do have private options, no service as far as I can tell allows to whitelist embeds (eg, only allow embeds on certain domains.) Vimeo can do this with videos and I don’t mind paying for this service either. Any ideas?

I’ve also looked into PDFJS and it seems they have a NodeJS implementation so I was thinking maybe PDFJS could grab the PDF from the server on the server side and just stream it to the client without exposing the original PDF url. However I couldn’t find good documentation for PDFJS.

Any help would be greatly appreciated.

Answer 1

This can be achieved with any HTTP server, but since you mentioned Node in your question, we will solve the problem with that technology. I am assuming Express Framework as well.

First you simply host the PDF as a static file on your server. Then you would register some Middleware that detects a request for the PDF. If the hostname that is requesting does not match a list of “approved” domains, then you serve an error back to the client. If the domain is approved, you serve the PDF. This is no different then a .htaccess file in Apache that limits access by domain/IP or an “allow” block in a Nginx config. Here is a quick look at the Middleware function…

var approved = []; // Add your approved domains here.

// Make sure this middleware comes before app.use(express.static)
app.use(function(req, res, next){
    if(req.url == '/path/to/PDF') {
        if(approved.indexOf(req.headers.host) {
            next();
        } else {
            next(new Error('Nu uh uh!')); 
        }
    } else {
        next();
    }
});

This way even if they copy the embed code, they will get an error from the server (probably should be a 403, but those are semantics you can decide on yourself)