# Security

webViewer Server adopts JSON Web Token (jwt) type to authenticate the user access. Your Authentication Server generates a token that certifies the user identity, and sends it to Foxit Web Viewer. Web Viewer will send the token back to webViewer Server to let the server know this particular identity has the permission to the access certain documents.

You may refer to jwt.io (opens new window) for how to generate JWT token.

Currently, webViewer Server only recognizes the 'exp (expiration time)' claim specified inside the JWT. Once the token is on or after this exp value, the request with this token becomes invalid, and not be accepted or processed.

# Enable JWT validation on webViewer server

By default, the JWT Authentication is disabled, but can be enabled by configuring the docker-compose.yml file.  Currently, the supported algorithm is HS256,HS384,HS512,RS256 ,RS384,RS512. This section will take HS256 and RS256 as examples to configure the yml file.

Enable  HS256 validation example

Suppose the private key is 123, then in the docker-compose.yml, add the following environment variables:

S8_WEBPDF_SECRET_JWT_ALG=HS256
S8_WEBPDF_SECRET_JWT_KEY=MTIz

The MTIz is the base64 form of private key 123. In your Authentication server, you will pass the HS256 and MTIz to genenrate a token, and pass it to the clien side - webViewer.

Enable RS256 validation example

1.Use RS256 to generate a pair of private and public key:

openssl genrsa -out rs256.key 2048
openssl rsa -in rs256.key -pubout  -outform PEM -out rs256_pub.pem

An example of the public key - rs256_pub.pem:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnWZFgIRR9rKrELY6ag37
2vSv8wy5MFamMFUFgwbnr9xtR1GxVlYoZ+itDlSG8TZvhQSDumraRKxHNDSpwzfE
bRTqaMk4wqocm5ZqqRH7C80VN7IIzg8XHcD/5BnZ/SaiFfV0RDyiCl7zjwt7Oysk
l829BxBb3G6U3yCMfld9MY3IpK/CuKlHtwvmhezXKPSnRDiq6vwJ1UwoD6Fy2pEd
CCdTAaBuuHe/XF1xCVR4ul+uXR4gGParkXfskOHbTgMm82ZimqCWeAOIhqwiL24y
BOm0lHXv4Ql0cWtOgFQv8mzE2cnTc0txpO2wFxr3C0BloYEX15cm+88h/GfLcLur
qwIDAQAB
-----END PUBLIC KEY-----
  1. In the docker-compose.yml, set the algothrim and public key to the corresponding environment variables:
S8_WEBPDF_SECRET_JWT_ALG=RS256
S8_WEBPDF_SECRET_JWT_KEY=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnWZFgIRR9rKrELY6ag372vSv8wy5MFamMFUFgwbnr9xtR1GxVlYoZ+itDlSG8TZvhQSDumraRKxHNDSpwzfEbRTqaMk4wqocm5ZqqRH7C80VN7IIzg8XHcD/5BnZ/SaiFfV0RDyiCl7zjwt7Oyskl829BxBb3G6U3yCMfld9MY3IpK/CuKlHtwvmhezXKPSnRDiq6vwJ1UwoD6Fy2pEdCCdTAaBuuHe/XF1xCVR4ul+uXR4gGParkXfskOHbTgMm82ZimqCWeAOIhqwiL24yBOm0lHXv4Ql0cWtOgFQv8mzE2cnTc0txpO2wFxr3C0BloYEX15cm+88h/GfLcLurqwIDAQAB

In your Authentication, you will pass the algothrim and private key to genenrate a token and then pass it to the open file functions to the client side -webViewer.

# Enable JWT authentication on webViewer

You can pass the paramenter jwt to one of the following open file functions to enable JWT authentication.

  • PDFViewer.openPDFByFile
  • PDFViewer.openPDFByHttpRangeRequest
  • PDFViewer.openPDFById
  • PDFViewer.reopenPDFDoc

Example:

pdfui.openPDFByHttpRangeRequest(request,{
      jwt: getJWT()  
      })
pdfui.openPDFByFile(pdfDoc,{
      jwt: getJWT()  
      })
pdfui.openPDFByID(docID,{
      jwt: getJWT()  
      })
pdfui.reopenPDFDoc(pdfDoc, {
      jwt: getJWT()  
      })