FUNBREW PDFFUNBREW PDF
Invalid Date

PDF generation APIs handle sensitive business documents — invoices, contracts, reports, and certificates. When you send confidential data to an external API, security must be a top priority in your evaluation.

This guide covers the essential security practices for safely integrating a PDF generation API into your production systems.

Why PDF API Security Matters

Data sent to PDF generation APIs often includes:

  • Invoices: Customer names, addresses, transaction amounts, bank details
  • Contracts: Terms, signatures, personally identifiable information
  • Reports: Revenue data, KPIs, internal metrics
  • Certificates: Full names, credentials, ID numbers

A breach of this data can result in legal liability, compliance violations, and loss of customer trust. When choosing a PDF API, evaluate security alongside features and pricing.

1. Secure API Key Management

Your API key is the access credential to the PDF generation service. If it leaks, anyone can generate PDFs — and incur charges — on your behalf.

Do This

# Store in environment variables (recommended)
export FUNBREW_PDF_API_KEY="sk-your-api-key"

// Read from environment at runtime
const apiKey = process.env.FUNBREW_PDF_API_KEY;

const response = await fetch('https://api.pdf.funbrew.cloud/v1/pdf/from-html', {
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  // ...
});

Never Do This

// BAD: Hardcoded in source code
const apiKey = "sk-live-abc123def456";  // Never do this

// BAD: Embedded in frontend JavaScript
// Anyone can see it in browser DevTools

API Key Best Practices

Practice Description
Environment variables Store keys in .env files or environment variables, never in code
.gitignore Never commit .env files to your repository
Key rotation Regenerate API keys regularly (every 90 days recommended)
Separate by environment Use different keys for development, staging, and production
Secret managers Use AWS Secrets Manager, HashiCorp Vault, or similar tools

2. Transport Encryption (TLS)

All communication with the PDF generation API must be encrypted via TLS (HTTPS).

import requests

# Always use HTTPS (TLS encryption)
response = requests.post(
    'https://api.pdf.funbrew.cloud/v1/pdf/from-html',  # HTTPS required
    headers={'Authorization': 'Bearer ' + api_key},
    json={'html': '<h1>Confidential Document</h1>'},
    timeout=30,  # Always set a timeout
)

What to Verify

  • TLS 1.2+: Ensure older protocols (SSL 3.0, TLS 1.0/1.1) are disabled
  • Certificate validation: Never disable SSL verification (verify=False is prohibited)
  • HSTS: Check for the Strict-Transport-Security header

3. Generated File Data Protection

How generated PDFs are stored and delivered requires careful consideration.

Automatic File Deletion

PDFs stored indefinitely increase your attack surface. Verify:

  • Automatic deletion policy (e.g., files deleted after 24 hours)
  • Download URL expiration
  • Download count limits

Secure Download URLs

// Signed URLs include expiration and authentication
const result = await response.json();
const downloadUrl = result.data.download_url;
// → https://api.pdf.funbrew.cloud/dl/abc123?expires=1711800000&sig=...

// Access denied after expiration

Unpredictable URLs combined with expiration times prevent unauthorized access to generated files.

4. Access Control and IP Restrictions

Limit API access to only what's necessary to reduce the risk of misuse. For network-level access controls in containerized environments, see the Docker/Kubernetes PDF API guide.

IP Allowlisting

# Configure allowed IPs in the dashboard
# Example: Only allow production server IPs
# 203.0.113.10  (Production web server)
# 203.0.113.20  (Production batch server)

Rate Limiting

In addition to API-side rate limits, implement request throttling in your application.

// Laravel: Rate limiting example
// 10 requests per minute per user
RateLimiter::for('pdf-generation', function (Request $request) {
    return Limit::perMinute(10)->by($request->user()->id);
});

This minimizes damage in case of account compromise.

5. Input Validation

Always validate and sanitize data before sending it to the PDF generation API.

XSS and Injection Prevention

// Escape user input before embedding in HTML
function escapeHtml(str) {
  return str
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;');
}

const html = `
  <h1>Invoice</h1>
  <p>Bill to: ${escapeHtml(customerName)}</p>
  <p>Amount: ${escapeHtml(amount)}</p>
`;

Use Templates Instead

With a template engine, the HTML structure is fixed and only data variables are injected. This is inherently safer than accepting arbitrary HTML input.

curl -X POST https://api.pdf.funbrew.cloud/v1/pdf/from-template \
  -H "Authorization: Bearer $FUNBREW_PDF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "invoice",
    "variables": {
      "customer_name": "Acme Corp",
      "total": "1,650.00"
    }
  }'

Templates are registered in the dashboard beforehand, preventing malicious HTML injection.

6. SSRF (Server-Side Request Forgery) Prevention

When sending HTML to a PDF generation API, attackers can embed URLs that target internal network resources. This is known as SSRF, and it's a critical risk for any service that fetches external resources on behalf of users.

SSRF Attack Examples

<!-- Attacker-submitted HTML -->
<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" />
<!-- Attempts to read AWS metadata endpoint for credentials -->

<iframe src="http://192.168.1.1/admin" />
<!-- Attempts to access internal admin panel -->

Mitigation

// Sanitize HTML server-side before sending to the API
function sanitizeHtmlForPdf(html) {
  // Allowlist of permitted external domains
  const allowedDomains = [
    'fonts.googleapis.com',
    'cdn.example.com',
    'your-assets.s3.amazonaws.com',
  ];

  // Detect references to internal IP ranges
  const internalPatterns = [
    /https?:\/\/localhost/gi,
    /https?:\/\/127\./gi,
    /https?:\/\/10\./gi,
    /https?:\/\/172\.(1[6-9]|2\d|3[01])\./gi,
    /https?:\/\/192\.168\./gi,
    /https?:\/\/169\.254\./gi,
  ];

  for (const pattern of internalPatterns) {
    if (pattern.test(html)) {
      throw new Error('Internal URL references are not allowed');
    }
  }

  return html;
}

When using a managed API, verify that the provider blocks requests to private IP addresses during resource fetching. FUNBREW PDF blocks all private IP access during PDF rendering.

7. Compliance and Data Residency

Sending business data to an external API triggers regulatory requirements depending on your jurisdiction.

GDPR (EU General Data Protection Regulation)

If you process EU personal data, verify:

  • Data Processing Agreement (DPA): A DPA is in place with the API provider
  • Data residency: Where personal data is processed and stored
  • Data minimization: Only send the minimum data needed for PDF generation
  • Right to erasure: You can request complete deletion of generated data

Implementation: Sensitive Data Masking

import re

def mask_sensitive_data(html: str) -> str:
    """Mask sensitive data before sending to the PDF API"""
    # Social Security Number masking
    html = re.sub(
        r'\b\d{3}-\d{2}-\d{4}\b',
        '***-**-****',
        html
    )

    # Credit card masking (show last 4 digits only)
    html = re.sub(
        r'\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?(\d{4})\b',
        r'****-****-****-\1',
        html
    )

    return html

8. OWASP Top 10 Relevance

Key OWASP Top 10 items that apply to PDF generation API usage:

OWASP Item PDF API Risk Mitigation
A01: Broken Access Control Unauthorized access to other users' PDFs Signed URLs + expiration
A02: Cryptographic Failures Data interception in transit TLS 1.2+ mandatory
A03: Injection HTML/CSS injection Input escaping + templates
A05: Security Misconfiguration API key exposure Environment variables + secret managers
A07: Auth Failures API key reuse across environments Environment separation + rotation
A09: Logging Failures Delayed incident detection Audit logs + alerts
A10: SSRF Accessing internal network resources URL validation + managed API

PDF-Specific Security Risks

PDF generation introduces unique attack vectors beyond standard web vulnerabilities.

// Malicious JavaScript embedded in PDFs
// → Use templates to prevent script execution from user input

// Malicious font files loaded via @font-face
// → Restrict allowed font sources

// Oversized HTML payloads for DoS
// → Set request size limits

const MAX_HTML_SIZE = 5 * 1024 * 1024; // 5MB

function validatePdfRequest(html) {
  if (Buffer.byteLength(html, 'utf-8') > MAX_HTML_SIZE) {
    throw new Error('HTML size exceeds the maximum allowed size');
  }

  // Strip script tags
  const sanitized = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');

  return sanitized;
}

9. Audit Logging and Monitoring

Logging is essential for early detection of security incidents and post-incident investigation. For serverless environments such as AWS Lambda, see the serverless PDF API guide for environment-specific logging patterns.

What to Log

  • API call timestamps, IP addresses, user IDs
  • Generated PDF filenames and sizes
  • Errors and anomalous request patterns
  • API key usage statistics

Alert Configuration

  • High request volume in a short period (possible abuse)
  • Access from unknown IP addresses
  • Consecutive authentication failures

Security Checklist

A summary of what to verify when adopting a PDF generation API in an enterprise setting.

Category Check Item Priority
Auth API keys stored in environment variables Required
Auth Separate keys for production and development Required
Transport HTTPS (TLS 1.2+) for all communication Required
Data Automatic deletion policy for generated files Required
Data Download URLs have expiration times Recommended
Access IP allowlisting configured Recommended
Access Rate limiting implemented Recommended
Input User input is escaped/sanitized Required
Input Templates used to fix HTML structure Recommended
Audit API calls are logged Recommended
Audit Anomaly detection alerts configured Recommended

Conclusion

PDF API security requires both technical controls and operational processes.

  • API key management: Environment variables with regular rotation
  • Transport encryption: TLS 1.2+ mandatory
  • Data protection: Auto-deletion and signed download URLs
  • Access control: IP restrictions and rate limiting
  • Input validation: Templates and HTML escaping
  • Audit logging: Log all API calls and detect anomalies

FUNBREW PDF is designed to meet these security requirements. Start with the free plan to evaluate the security features, review the API documentation for details, and test safely in the Playground.

Related

Back to all posts
Powered by FUNBREW PDF