Crypto.suble error when generating PDF's without HTTPS

1

@lubos this regards the recently closed issue Server Edition - PDF/Email Issues

I’ve done some digging and found that the date sensitive issue that gives the crypto.subtle error originates from pdf.js and specifically the caching of already rendered PDF’s

it’s caused by this specific line.
const key = await sha256Hex(html);

the “sha256Hex()” function only works in secure context (e.g when manager is running in an https context)

The simple way to rectify this would be to use a different checksum algorithm (md5 would suffice) from a library which doesn’t depend on a secure context.

or just guard the cache so that only users on https get the benefit of the cache, your call.

2

@John_Pycroft your diagnosis makes sense. The important point is that crypto.subtle is only available in a secure browser context, normally HTTPS or localhost. So if PDF generation depends on:

const key = await sha256Hex(html);

and sha256Hex() uses crypto.subtle.digest(...), it can fail when the app is served over plain HTTP.

As a matter of security I would avoid treating MD5 as the first fix unless one can be 100% sure this hash is only used as a local cache key and never for security, integrity, signing, or access control. For a render cache key such as PDF generation, a weaker/non-cryptographic hash can be acceptable, but the cache should still be scoped carefully, especially if PDFs may contain user-specific or private data. As Manager deals with finances I prefer the more secure option.

The cleanest fix would be to make the cache optional:

  1. If running in a secure context, use the existing SHA-256 cache key.
  2. If not running in a secure context, either disable the PDF render cache or use a clearly non-security fallback hash.
  3. PDF generation itself should still work even if caching is unavailable.

Something like:

if (window.isSecureContext && crypto?.subtle) {
  key = await sha256Hex(html);
  // use cache
} else {
  // skip cache, or use a non-security fallback hash
  // but do not let PDF generation fail just because the cache key cannot be created
}

Long term, HTTPS is still the best fix, because browser APIs increasingly require secure contexts. But as a code fix, the cache should be guarded so a missing crypto.subtle disables the optimization rather than breaking PDF generation. On self-hosted Manager Server edition Caddy + Let’s Encrypt (Best if you can put a reverse proxy in front of the app. Very low maintenance) is the easiest route because it automatically gets and renews HTTPS certificates and redirects HTTP to HTTPS for you.

If you already installed Nginx/Apache then use Nginx/Apache + Certbot + Let’s Encrypt.

Alternatively, If you use a home/private server without open ports: use Cloudflare Tunnel.

I am not a fan of reducing security, it is better to harden the server.