Preventing or detecting download on iframe

I have a problem which seemed common to me, but I couldn't find a right solution.

I have a document showing up via iframe. On the top there is a toolbar where the end user can download a document. Now I want to either log the information about downloading (so I need some event maybe) or disable the download option.

I know that I can disable whole toolbar by adding #toolbar=0, but the end user can just change it by himself and still download the document without logging it, so it is not a suitable solution for me.

If you're not dead set on an iframe, you can use an embed or object tag instead to prevent such a toolbar from appearing.

With iframes specifically, if you want to disable download functionality you're probably going to end up with something browser specific, because different browsers translate iframes into different elements to actually render the PDF. If you know exactly what browser you're dealing with, you could try unbinding the listener from the download button, here is a solution that I tested in Chrome that seems to work:

var old_element = document.getElementById("viewer").shadowRoot.getElementById("toolbar").shadowRoot.getElementById("downloads").shadowRoot.getElementById("download");
var new_element = old_element.cloneNode(true);
old_element.parentNode.replaceChild(new_element, old_element);

Credits to Ben D for their answer to this question on listener removal, and you can replace the cloneNode and replaceChild steps with addEventListener if you want to go down the logging route. I think this will still end up with issues where a sufficiently savvy/determined user will be able to download the PDF though (check out this article additional info: https://www.w3docs.com/snippets/html/how-to-embed-pdf-in-html.html), so depending on your end-goal, I would recommend rendering a static image preview of the PDF for guest users, while the full viewer could be restricted to logged-in users.

PDF viewers in a Browser are a Binary Plug In for object embed in frame so they never can be relied on to be present as shown below. ALL PDFs in a browser will download first then be returned by the client DEVICE to an imbedded frame.

Also as a binary plug-in they do not have to allow JavaScript inside their controls so even if you say Toolbar=0 or copy protection is "use password" or low quality print or no copying those can all be ignored unless the extender allows the toolbar control to be honoured.