A proxy script to retrieve a PDF on a FileMaker server

fm-proxy-pdf-viewer.php

<?php
// Referenced in blog post, Learning the FileMaker Data API by trial and error.
// https://supergeekery.com/blog/learning-the-filemaker-data-api-by-trial-and-error
// Sample URL hitting this proxy:
// https://my-proxy-server.com/api/fm-proxy-pdf-viewer.php?token=123&pdfUrl=https%3A%2F%2Fexample-filemaker-server.com%2FStreaming_SSL%2FMainDB%abc.pdf%3FRCType%3DEmbeddedRCFileProcessor

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS' && isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) {
  // This is a preflight request, so send the CORS headers
  header('Access-Control-Allow-Origin: *');
  header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE');
  header('Access-Control-Allow-Headers: Authorization, Content-Type');
  header('Access-Control-Max-Age: 60');
  exit();
}

// Set the CORS headers now that we're done with the preflight
header('Access-Control-Allow-Origin: *');

try {
  $get = $_GET;

  // get the pdfUrl from the post data
  $pdfUrl = $get['pdfUrl'] ?? null;
  $token = $get['token'] ?? null;

  // The pdfUrl was URLencoded, so we need to decode it
  $pdfUrl = urldecode($pdfUrl);

  $headers = [
    'Content-Type: application/json',
    "Authorization: Bearer $token",
  ];

  // REFERENCE: https://github.com/msyk/FMDataAPI/blob/e664f81d4c141c757e5a03087c11e51607112c11/src/Supporting/CommunicationProvider.php#L690
  $cookieFile = tempnam(sys_get_temp_dir(), "CURLCOOKIE"); //create a cookie file

  // open the pdfUrl and get the contents of the pdf
  $ch = curl_init($pdfUrl);

  curl_setopt($ch, CURLOPT_COOKIEJAR, $cookieFile); // save cookies
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); // Follow redirects
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // Return the contents of the PDF file
  curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); // Set the headers
  curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1); // Disable HTTP/2
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // Don't verify SSL CERT
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); // Don't verify SSL CERT
  curl_setopt($ch, CURLOPT_VERBOSE, 1); // Verbose output
  curl_setopt($ch, CURLOPT_TIMEOUT, 5); // 5 seconds timeout. If the server is not responding, then we will not wait for it to respond.
  curl_setopt($ch, CURLOPT_FRESH_CONNECT, 0); //Don't use cache
  $pdf = curl_exec($ch);
  curl_close($ch);

  // display the PDF file
  header('Content-type: application/pdf');
  header('Content-Disposition: inline; filename="file.pdf"');
  header('Content-Transfer-Encoding: binary');
  header('Accept-Ranges: bytes');
  echo $pdf;
} catch (JsonException $e) {
  http_response_code(403);
  die('Access denied. Invalid token.');
}