[Bug]: 403 Error When Loading PDF from Azure SAS URL via PDF.js Viewer in React Iframe

[akashlbmc]

Attach (recommended) or Link to PDF file

Description:
Hi, I'm implementing PDF.js in a React codebase using the prebuilt viewer version from https://mozilla.github.io/pdf.js/getting_started/.

I'm embedding the viewer using an <iframe> to leverage the default PDF.js toolbar. The PDF files are hosted as blob content in Azure Storage, and I’m generating a SAS (Shared Access Signature) URL to provide access to these files.

Here's the code snippet I’m using:

<iframe
    src={`/pdfjs/viewer.html?file=${encodeURIComponent(pdfUrl || "")}#page=${pageNumber || "1"}`}
    width="100%"
    height="100%"
    title="PDF Viewer"
    onError={() => {
        alert("Failed to load PDF. Please check the URL or your connection.");
    }}
/>

Problem:

The PDF renders correctly sometimes, but other times I receive a 403 Forbidden error when accessing the SAS URL. This issue appears inconsistent, which makes it hard to debug.

Additional Info:

• The SAS URL is correctly formed and works when opened directly in the browser.
• The PDF.js viewer is hosted locally in the React project.
• CORS has been enabled on the Azure Blob Storage container.
• PDF URLs look like: https://<account>.blob.core.windows.net/<container>/<file>.pdf?<SAS-token>

Questions:

1. Is there anything specific about how PDF.js fetches the file that could cause a 403 on valid SAS URLs?
2. Could the iframe context or referrer policy be affecting the request to the SAS URL?
3. Are there any recommendations for securely and reliably loading PDFs from SAS URLs in the PDF.js iframe viewer?

Any help or guidance would be appreciated!

Thanks.

Web browser and its version

Google Chrome 140.0.7339.185

Operating system and its version

Windows 11

PDF.js version

v5.4.149

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

• Download prebuild zip.
• Copy paste code in public directory in react app.
• Use pdfjs to render sas url.

What is the expected behavior?

Even after multiple refresh it wont break with iframe.

What went wrong?

Link to a viewer

No response

Additional context

No response