1465074 - Allow range requests to pass through a service worker

Status: NEW

(Core :: DOM: Service Workers, defect, P2)

Description

[Jake Archibald [:jakea]]

Spec change: https://github.com/whatwg/fetch/pull/560.
Tests: https://github.com/web-platform-tests/wpt/pull/10348.
Security issues to pay attention to: https://github.com/whatwg/fetch/issues/144#issuecomment-368040980

This spec change means that rage requests (such as those from media elements) are allowed to pass through a service worker as long as they aren't modified. This fixes a long standing issue where media elements behave oddly if intercepted by a service worker (as the range headers were lost).

How media elements ingest partial responses remains unspecified for now. See the attacks in https://github.com/whatwg/fetch/issues/144#issuecomment-368040980 & their mitigations. Attack 4 is already covered in the tests.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Looks like we already blocked 206 responses in Cache API in bug 1264181.

Comment 3

[Christian]

Unfortunately Firefox is currently the only browser that is not supporting range requests in service workers. See here: https://wpt.fyi/results/fetch/range/sw.https.window.html?label=master&label=experimental&aligned

Recent versions of Safari and Chromium since Version 87 support this really well (https://web.dev/sw-range-requests/). It is really unfortunate that our web app can not support Firefox because of this issue...

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 5

[Jens Stutte [:jstutte]]

Seems still unsupported.