jsp refers to an PDF streaming servlet - security question -

somewhere behind our firewall sits server full of pdfs. pdfs contain private information need restrict access pdfs. public can log in our web site , request pdfs.

our software went production recently. we're redirecting them pdf server's url. fails because public can't access our pdf server. thing though have preferred prove before launch.

i wrote pdf servlet stream pdf users' browsers. our jsps refer servlet using <object> html tag. prototype works fine.

i don't want world have direct access servlet since fiddle url , inappropriately grab pdf.

now, finally, questions. can jsp refer pdf servlet if servlet behind firewall? pdfs display in-line? users "save?" dialog box?

can jsp refer pdf servlet if servlet behind firewall?

the pdf request counts separate http request. servlet has no idea if behind firewall or been called jsp. safest approach check presence of user credentials in either http headers or in http session.

will pdfs display in-line? users "save?" dialog box?

that depends on presence of content-disposition header and/or browser's configuration. if header absent or explicitly set inline , browser supports content type specified in content-type header, displayed inline, otherwise ask it: open in application or save it. if header set attachment, depends on browser config. default, should pop save as dialog, user may have configured browser open in external application instead.