Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
node-signpdf
Advanced tools
It is being replaced by @signpdf.
Simple signing of PDFs in node.
The purpose of this package is not as much to be used as a dependendency, although it could. The main purpose is to demonstrate the way signing can be achieved in a piece of readable code as it can take a lot of hours to figure out.
Install with npm i -S node-signpdf node-forge
.
In practice we expect that most people will just read through the code we've written in the testing part of this package and figure it out themselves. If that's your case, you should read the [Signing PDF in simple steps] section.
You have already created a PDF using foliojs/pdfkit and you want to sign that. Before saving (writing to fs, or just converting to Buffer
) your file, you need to a add a signature placeholder to it. We have a helper for that. This is demonstrated in the signs input PDF
test.
Once you have the placeholder, just [sign the document].
Yes. This is new since version 1.0. We have a helper that can add a signature placeholder in at least the most basic PDFs without depending on pdfkit. You can see how this is done in the signs a ready pdf
test.
Once you have the placeholder, just [sign the document].
import signer from 'node-signpdf';
...
const signedPdf = signer.sign(
fs.readFileSync(PATH_TO_PDF_FILE),
fs.readFileSync(PATH_TO_P12_CERTIFICATE),
);
Contents
descriptor in the Sig
be placed after the ByteRange
one;Buffer
s of the PDF and a P12 certificate to use when signing;See the unit-testing code. PDFKit is used there for generating the document. This also allows easy addition of the signature placeholder.
What's needed is a Sig
element and a Widget
that is also linked in a Form
. The form needs to be referenced in the root descriptor of the PDF as well. A (hopefully) readable sample is available in the helpers. Note the Contents
descriptor of the Sig
where zeros are placed that will later be replaced with the actual signature.
This package provides two helpers for adding the signature placeholder:
Note: Signing in detached mode makes the signature length independent of the PDF's content length, but it may still vary between different signing certificates. So every time you sign using the same P12 you will get the same length of the output signature, no matter the length of the signed content. It is safe to find out the actual signature length your certificate produces and use it to properly configure the placeholder length.
To produce PAdES compliant signatures, the ETSI Signature Dictionary SubFilter value must be ETSI.CAdES.detached
instead of the standard Adobe value.
This can be declared using the subFilter option argument passed to pdfkitAddPlaceholder
and plainAddPlaceholder
.
import { SUBFILTER_ETSI_CADES_DETACHED, pdfkitAddPlaceholder } from 'node-signpdf';
const pdfToSign = pdfkitAddPlaceholder({
...,
subFilter: SUBFILTER_ETSI_CADES_DETACHED,
});
That's where the Signer kicks in. Given a PDF and a P12 certificate a signature is generated in detached mode and is replaced in the placeholder. This is best demonstrated in the tests.
node-forge is used for working with signatures.
PDFKit is used in the tests for generating a PDF with a signature placeholder.
node-signpdf
is and is being [3.0.0]
node-signpdf
to be replaced by the @signpdf
scoped packages;@signpdf/placeholder-pdfkit010
and @signpdf/placeholder-plain
;@signpdf/signpdf
understands PDFs and @signpdf/signer-p12
understands P12 and node-forge
;contactInfo
, location
and name
which used to be optional;packages/examples
;FAQs
DEPRECATED. Have a look at @signpdf/signpdf instead.
The npm package node-signpdf receives a total of 5,011 weekly downloads. As such, node-signpdf popularity was classified as popular.
We found that node-signpdf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.