Chrome and PDFs requiring web authentication showing only the first page, then dots

Recently a user told us that only the first page of their PDF was showing, and all subsequent pages were just showing as tiny dots:

After a little debugging we found an issue with Chrome that was related to this.

To reproduce the bug the following must be true:

1. The PDF must require a cookie to access (for instance, by using the Drupal private file system).
2. The browser must be set to render the PDF instead of downloading it
3. The PDF must be saved with linearization (“Optimize for fast web view”)

Ultimately, when Chrome detects a linearized PDF it treats the file more like a movie than an arbitrary binary object, and after getting the first page, it issues HTTP Range Requests for more pages in order to (appear to) speed things up. Unfortunately, these additional range requests don’t appear to include the cookie which results in a server error, probably a 403 if you have things setup correctly. You should be able to tail your logs to find the multiple requests, and the duplicates will list the file itself as the referer.

example.org 127.0.0.1 - - [14/Oct/2020:15:57:11 -0500] "GET /system/files/documents/file.pdf HTTP/1.1" 200 12607446 "https://example.org/page/x/y/z" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36"
example.org 127.0.0.1 - - [14/Oct/2020:15:57:12 -0500] "GET /system/files/documents/file.pdf HTTP/1.1" 403 26966 "https://example.org/system/files/documents/file.pdf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36"
example.org 127.0.0.1 - - [14/Oct/2020:15:57:12 -0500] "GET /system/files/documents/file.pdf HTTP/1.1" 403 26966 "https://example.org/system/files/documents/file.pdf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36"

The only fix that we would so far is to re-save or re-export without linearization. You can do that from Acrobat by performing a File, Save as Other, Optimized PDF. In the window that opens, uncheck everything on the except “Clean Up”, and for that option uncheck all of the settings:

If you want to know if a file has linearization applied to it you can open it a hex editor like XVI32, and in the first could of dozen bytes look for <</Linearized.