Skip to content

PDF Lazy Loader 1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 21:25
· 1 commit to main since this release
v1.3.0
29649a2
  • Server-side Turnstile verification (optional, Settings → Cloudflare Turnstile → Server-side verification): REST endpoint POST /wp-json/pdf-lazy-loader/v1/verify validates the token with Cloudflare siteverify (single-use, action pdf_view, hostname check) and only then returns the PDF URLs
  • In server mode the HTML contains an AES-256-GCM sealed reference (data-pll-ref) instead of the XOR-obfuscated URL; download URL is released the same way; REST wp/v2 output is sealed too
  • Stateless: no DB writes, full-page cache compatible; forged refs rejected before any outbound call; one token unlocks all PDFs on the page; optional rate limit with persistent object cache
  • Server-Timing header on the endpoint for latency diagnostics
  • Viewer assets download in parallel with the Turnstile challenge
  • Secret Key is no longer printed back into the settings form (empty field keeps the stored key)

Full Changelog: v1.2.1...v1.3.0

Assets 4
Loading