[whatwg/fetch] Block opaque 416 responses to range requests (Issue #1906)

yoshisatoyanagisawa created an issue (whatwg/fetch#1906)

### What is the issue with the Fetch Standard?

The current Fetch Standard specifies that for an opaque response with the range-requested flag set, but without an originating Range header in the request, a 206 Partial Content status code should result in a network error. This is a crucial security check designed to prevent XS-Leak attacks that could reveal resource sizes.

However, this check is limited to 206 status codes and does not apply to 416 Range Not Satisfiable responses, which are also used for failed Range requests.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1906
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1906@github.com>