What do you mean? At least the current URL [0] returns a response of content-type application/pdf. So the builtin pdf viewer of your browser should display it, no? I know sometimes admins change URLs tho.

[0]: https://dl.acm.org/doi/pdf/10.1145/3309074.3309076

No.

https://knightoftheinter.net/img/Screenshot_20210506_195521....

https://knightoftheinter.net/img/Screenshot_20210506_195855....

Huh interesting, I can confirm. If you add the JSESSIONID cookie manually via -b param to the curl request it works tho. No JS needed, pure curl.

Even so, I'm not interested in providing or generating something random. If the site doesn't want to work with someone who values privacy then I don't want to work with that site. :)

Yeah, it only works if you have cookies enabled(works with js disabled). You could use containers or CookieAutoDelete if you use firefox to auto delete cookies later. Or just configure the browser to be on incognito mode always with only third-party cookies disabled.