Appearance

PDF Proxy API ​

File Information ​

  • Path: server/api/pdf/proxy.get.ts
  • Purpose: Server-side proxy for PDF asset URLs so the in-app PDF viewer can load cross-origin PDFs with authentication and avoid CORS issues
  • Method: GET

Overview ​

The client passes a PDF URL as the url query parameter. The server validates the URL (must be HTTP or HTTPS), verifies the request has an authenticated user (HTTP-only cookie auth_token), fetches the PDF from the upstream URL, validates that the response is PDF (by Content-Type or Content-Disposition), and streams the response back to the client. Range requests are forwarded for byte-range support.

Query Parameters ​

ParameterTypeRequiredDescription
urlstringYesFull URL of the PDF to fetch (e.g. asset CDN URL). Must be a valid HTTP or HTTPS URL.

Authentication ​

  • Requires the auth_token HTTP-only cookie. If missing, responds with 401 Unauthorized.

Response ​

  • Success: Streams the PDF body with appropriate headers (Content-Type, Content-Length, Accept-Ranges, Content-Range, Cache-Control, etc.). Status may be 200 or 206 (partial content).
  • 400: Missing or invalid url, or unsupported protocol.
  • 401: No auth cookie.
  • 415: Upstream response is not a PDF (Content-Type/Content-Disposition check).
  • 502 / upstream status: Upstream fetch failed or returned non-2xx (except 206).

Usage ​

Used by usePdfJsViewer (and thus PdfJsViewer) when the PDF URL is cross-origin: the viewer requests /api/pdf/proxy?url=${encodeURIComponent(pdfUrl)} with credentials so the server can attach the auth cookie and stream the PDF.