Most browsers nowadays have a PDF viewer, so an iframe would satisfy 90 % of the needs here.

Mix'n'match uses simple iframes in its visual match: https://bitbucket.org/magnusmanske/mixnmatch/src/master/public_html/visual_match.html?fileviewer=file-view-default

https://github.com/dissemin/oabot/pull/13

Simplistic patch.

Thanks a lot! It looks great to me. I will merge in the hope that it does not go against WMF's policy for third-party content: T166604 .

I've tried the deployed version on Chromium and it seems to work fine.

For the third-party requests, the most important thing is that the user knows what's going on. In this case it seems rather obvious because there is a visual indication that the third party URL is being loaded, but we could add a short sentence about it.

I considered adding an origin or sandbox attribute (e.g. to disable cookies) but they don't seem to help that much: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

I believe there used to be a proxy through which to load third-party resources but I can't find any such thing.

Is this resolved?