1465074 - Allow range requests to pass through a service worker

Status: ASSIGNED

(Core :: DOM: Service Workers, defect, P2)

Description

[Jake Archibald [:jakea]]

Spec change: https://github.com/whatwg/fetch/pull/560.
Tests: https://github.com/web-platform-tests/wpt/pull/10348.
Security issues to pay attention to: https://github.com/whatwg/fetch/issues/144#issuecomment-368040980

This spec change means that rage requests (such as those from media elements) are allowed to pass through a service worker as long as they aren't modified. This fixes a long standing issue where media elements behave oddly if intercepted by a service worker (as the range headers were lost).

How media elements ingest partial responses remains unspecified for now. See the attacks in https://github.com/whatwg/fetch/issues/144#issuecomment-368040980 & their mitigations. Attack 4 is already covered in the tests.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Looks like we already blocked 206 responses in Cache API in bug 1264181.

Comment 3

[Christian]

Unfortunately Firefox is currently the only browser that is not supporting range requests in service workers. See here: https://wpt.fyi/results/fetch/range/sw.https.window.html?label=master&label=experimental&aligned

Recent versions of Safari and Chromium since Version 87 support this really well (https://web.dev/sw-range-requests/). It is really unfortunate that our web app can not support Firefox because of this issue...

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 5

[Jens Stutte [:jstutte]]

Seems still unsupported.

Comment 6

[Andrew Sutherland [:asuth] (he/him)]

Note changes discussed in https://github.com/whatwg/fetch/issues/1906 to "Block opaque 416 responses to range requests" in addition to 206 responses, for when we fix this.

Comment 7

[Eden Chuang[:edenchuang]]

Attachment: Bug 1465074 - Only remove privileged nocors request headers if RequestInit memebers presented in Request::Constructor. r=#dom-worker-reviewers

Comment 8

[Eden Chuang[:edenchuang]]

Attachment: Bug 1465074 - Return NetworkError while get a ranged response but not requested by a ranged request. r=#dom-worker-reviewers

Comment 9

[Eden Chuang[:edenchuang]]

Attachment: Bug 1465074 - Let ServiceWorker intercepts range requests. r=#dom-worker-reviewers

Comment 10

[Eden Chuang[:edenchuang]]

Attachment: Bug 1465074 - Update range request related web-platform test expectation. r=#dom-worker-reviewers