Display PDF from database without caching

[rolfejr]

I am trying to display a PDF in the users browser that is pulled from a
binary field in our database, and keep that PDF from caching on the
client computer. I can successfully pull the PDF and display it using
the following code:

Response.Conten tType = "applicatio n/pdf"
Response.Binary Write objRS("Attachme nt")

where objRS("Attachme nt") is a reference to the binary field retrieved
from the database. However, I have tried adding virtually every header
known to have anything to do with caching, and I cannot seem to prevent
the PDF from caching in the client's browser. So then I tried to use
the adodb.stream object, as follows:

set objStream=serve r.createObject( "ADODB.Stre am")
objStream.Open
objStream.Type= 1 'adTypeBinary
objStream.write objRS.fields("A ttachment").val ue

Response.Conten tType = "applicatio n/pdf"
Response.Binary Write objStream.Read( )

This follows, more or less, several examples I've found on the web,
although most examples are reading a file into the stream, not a binary
field returned from a database. This code gives me the following
error:

Response object, ASP 0106 (0x80020005)
An unhandled data type was encountered.

I'm looking for a way to make the stream work, or any other suggestions
on how to display the pdf to the client without it caching in their
browser.

[Anthony Jones]

<ro*****@gmail. comwrote in message
news:11******** **************@ k70g2000cwa.goo glegroups.com.. .

That's basically the conclusion that I had come to - there is a
Microsoft support document (several, actually) on the problem of
downloading PDF's over an SSL, but I'm not using SSL - actually, in
this particular scenario, the client may or may not use SSL (inside
the company they don't - outside they do). Anyway, I will experiment
some more with the private; no-store heading - at least now I know the
correct header - thanks.

As to the question about how do you prevent a client from just saving
the PDF - you don't, and as has been stated already, that is
irrelevant. Of course someone can just save the PDF from their browser
- that's not the concern. the concern is someone ELSE pulling from a
users cache without their knowledge. Basically I am dealing with
people's pay stubs in PDF form, so if they want to save it, fine - they
can do whatever they want with it. I just don't want people pulling
OTHER employees pay stubs from their internet caches - at home, at
work, at the library, etc, etc.

Yeah um just don't do that then.

Rather than mucking about with various headers lets just use the correct
headers for your requirement.

You want to attempt to stop the file from being cached at all. This

could

be a problem for PDFs.

The correct code to acheive this is:-

Response.CacheC ontrol = "private; no-store"

This informs all proxies between the origin server and the client not to
store a copy of the resource. It also tells the client that it should

not

keep a copy of the resource. (no-cache actually means keep a copy if

you

want but always check back with the origin server before using it)

The problem with this, at least with IE and PDFs, is that the

implementation

doesn't appear to be able to handle rendering a PDF stream directly, it
needs to map the stream in to a file so despite the http headers saying
otherwise it is stored anyway. Why it isn't deleted after it has been
finished with I don't know it ought to be possible.

[Mike Brind]

ro*****@gmail.c om wrote:

That's basically the conclusion that I had come to - there is a
Microsoft support document (several, actually) on the problem of
downloading PDF's over an SSL, but I'm not using SSL - actually, in
this particular scenario, the client may or may not use SSL (inside
the company they don't - outside they do). Anyway, I will experiment
some more with the private; no-store heading - at least now I know the
correct header - thanks.

As to the question about how do you prevent a client from just saving
the PDF - you don't, and as has been stated already, that is
irrelevant. Of course someone can just save the PDF from their browser
- that's not the concern. the concern is someone ELSE pulling from a
users cache without their knowledge. Basically I am dealing with
people's pay stubs in PDF form, so if they want to save it, fine - they
can do whatever they want with it. I just don't want people pulling
OTHER employees pay stubs from their internet caches - at home, at
work, at the library, etc, etc.

Is password-protecting the PDFs not an option?

--
Mike Brind

[rolfejr]

Is password-protecting the PDFs not an option?

I wish. The pdf's are stored in the database by third party software,
so I have no control over how they are created. There may be some
option of pulling them out, password protecting them, then putting them
back in the database using some third-party pdf app, but I wouldn't
really know where to begin there...

[Mike Brind]

Persits ASPPdf allows you to open existing PDF documents and alter their
security settings, including applying passwords.

http://www.asppdf.com/manual_08.html

You would probably have to create a temp copy of the PDF on the server,
apply new security settings to that, then stream it and delete the temp
file.

The 30 day evaluation is definitely worth taking up. And no, I'm not on
commission - I have found it to be a very good product :-)

--
Mike Brind
<ro*****@gmail. comwrote in message
news:11******** **************@ k70g2000cwa.goo glegroups.com.. .

>Is password-protecting the PDFs not an option?

I wish. The pdf's are stored in the database by third party software,
so I have no control over how they are created. There may be some
option of pulling them out, password protecting them, then putting them
back in the database using some third-party pdf app, but I wouldn't
really know where to begin there...

[rolfejr]

Thanks for the reference, I will definitely look into it.

Mike Brind wrote:

Persits ASPPdf allows you to open existing PDF documents and alter their
security settings, including applying passwords.

http://www.asppdf.com/manual_08.html

You would probably have to create a temp copy of the PDF on the server,
apply new security settings to that, then stream it and delete the temp
file.

The 30 day evaluation is definitely worth taking up. And no, I'm not on
commission - I have found it to be a very good product :-)

--
Mike Brind
<ro*****@gmail. comwrote in message
news:11******** **************@ k70g2000cwa.goo glegroups.com.. .

Is password-protecting the PDFs not an option?

I wish. The pdf's are stored in the database by third party software,
so I have no control over how they are created. There may be some
option of pulling them out, password protecting them, then putting them
back in the database using some third-party pdf app, but I wouldn't
really know where to begin there...