Steps to reproduce
When using XMLHttpRequest to fetch a byte range of a cross-origin file using ‘Range’ header, the ‘Range’ header is incorrectly sent with the CORS OPTIONS preflight request, which may cause the server to reject the OPTIONS request with a 416 “Range not satisfiable” error.
This seems to be new behavior in Win10 build 15002, and did not occur in earlier Insider builds I’ve tested.
Minimal test case at https://brionv.com/misc/edge-xhr/
Presence of incorrect ‘Range’ header on the OPTIONS preflight can be verified in the Network panel in F12 tools – the 416 status code and text are not returned to JS since they are part of the CORS preflight.
Note that ‘Range’ is not in the default set of request headers that is allowed for CORS, and is explicitly allowed via a response header seen by the OPTIONS preflight, which is why there’s a preflight needed… It should not be actually sent until the final request.
Comments and activity
Downstream bug for Wikipedia: https://phabricator.wikimedia.org/T155085
Looking at the Edge changelog, I think this is suspicious:
Enabled Media over Fetch and XHR over Fetch by default (previously behind a flag)
in regards to this bug with fetch:
I can confirm that if I uncheck the “XHR over Fetch” option in about:flags, things start working as expected.
- Microsoft Edge Team
Changed Assigned To to “Brandon M.”
Changed Status to “Confirmed”
Changed Status from “Confirmed” to “In code review”
Changed Status from “In code review” to “In progress”
Changed Status from “In progress” to “In code review”
Changed Status from “In code review” to “Fixed, not yet flighted”
Changed Status from “Fixed, not yet flighted” to “Fixed, flighted”
Based on the comments from our engineers, this issue is fixed. Please reactivate if you find further problems.
The MS Edge Team