Configure remote images

Remote image fetching is off by default. Enable it only for HTTPS locations that the application operator controls or trusts.

Add an allowlist

Configure exact URL prefixes with a trailing slash:

export default defineNuxtConfig({
  modules: ['@lupinum/nuxt-pdf'],
  pdf: {
    remote: {
      allow: [
        'https://cdn.example.com/brand/',
        'https://images.example.com/logos/',
      ],
      timeoutMs: 10_000,
    },
  },
})

Use an admitted URL in the template:

<PdfImage
  src="https://cdn.example.com/brand/logo.png"
  :style="{ height: 40, width: 120 }"
/>

The module follows at most three redirects and checks the allowlist at each hop. An allowed host cannot redirect to a disallowed location.

Understand the boundary

• Allowlist entries use https://host/path/. Wildcards, credentials, query strings, fragments, and missing trailing slashes are rejected.
• Requested image URLs can contain a query, but errors do not include it.
• Requests use GET without application headers, cookies, or credentials.
• PNG and JPEG signatures and dimensions are checked before layout. A response Content-Type cannot admit other bytes.
• Per-image bytes, total bytes, decoded pixels, request count, concurrency, and the full render deadline use the shared pdf.limits budget.
• Duplicate URLs are fetched once per render. No cross-render image cache is promised.

PDF_ASSET_BLOCKED means the source form, allowlist, redirect, or timeout policy rejected the request. PDF_ASSET_INVALID means admitted bytes were not a valid PNG or JPEG. Size and request-budget failures use PDF_LIMIT_EXCEEDED. See Errors and limits for the exact codes.