XHR CORS request with 'Range' header fails on OPTIONS preflight with 416 [build 15002]

Fixed, flighted Issue #10494718

Details

Created
Jan 11, 2017
Privacy
This issue is public.
Found in
  • Microsoft Edge
Found in build #
15.15002
Fixed in build #
15026
Reports
Reported by 1 person

Sign in to watch or report this issue.

Steps to reproduce

When using XMLHttpRequest to fetch a byte range of a cross-origin file using ‘Range’ header, the ‘Range’ header is incorrectly sent with the CORS OPTIONS preflight request, which may cause the server to reject the OPTIONS request with a 416 “Range not satisfiable” error.

This seems to be new behavior in Win10 build 15002, and did not occur in earlier Insider builds I’ve tested.

This affects video and audio playback on Wikipedia (https://wikipedia.org) and Wikimedia Commons (https://commons.wikimedia.org/), which is mediated via JavaScript.

Minimal test case at https://brionv.com/misc/edge-xhr/

Presence of incorrect ‘Range’ header on the OPTIONS preflight can be verified in the Network panel in F12 tools – the 416 status code and text are not returned to JS since they are part of the CORS preflight.

Note that ‘Range’ is not in the default set of request headers that is allowed for CORS, and is explicitly allowed via a response header seen by the OPTIONS preflight, which is why there’s a preflight needed… It should not be actually sent until the final request.

Attachments

0 attachments

    Comments and activity

    • Downstream bug for Wikipedia: https://phabricator.wikimedia.org/T155085

    • Looking at the Edge changelog, I think this is suspicious:
      Enabled Media over Fetch and XHR over Fetch by default (previously behind a flag)

      in regards to this bug with fetch:
      https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/9869121/

      I can confirm that if I uncheck the “XHR over Fetch” option in about:flags, things start working as expected.

    • Microsoft Edge Team

      Changed Assigned To to “Brandon M.”

      Changed Status to “Confirmed”

      Changed Status from “Confirmed” to “In code review”

      Changed Status from “In code review” to “In progress”

      Changed Status from “In progress” to “In code review”

      Changed Status from “In code review” to “Fixed, not yet flighted”

      Changed Status from “Fixed, not yet flighted” to “Fixed, flighted”

    • Hello:

      Based on the comments from our engineers, this issue is fixed. Please reactivate if you find further problems.

      Best Regards,
      The MS Edge Team

    You need to sign in to your Microsoft account to add a comment.

    Sign in