• HTTP
  • HTTP
  • A typical HTTP session
  • HTTP caching
  • HTTP conditional requests
  • Protocol upgrade mechanism
  • HTTP Observatory
  • Permissions Policy Experimental
  • CORS errors
    1. Reason: CORS header 'Origin' cannot be added
    2. Reason: CORS request not HTTP
    3. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
    4. Reference
    5. Accept-Encoding
    6. Accept-Ranges
    7. Access-Control-Allow-Origin
    8. Access-Control-Request-Method
    9. Alt-Used
    10. Attribution-Reporting-Eligible Experimental
    11. Attribution-Reporting-Register-Source Experimental
    12. Attribution-Reporting-Register-Trigger Experimental
    13. Connection
    14. Content-DPR Non-standard Deprecated
    15. Content-Location
    16. Content-Type
    17. Critical-CH Experimental
    18. Date
    19. DNT Non-standard Deprecated
    20. Downlink Experimental
    21. DPR Non-standard Deprecated
    22. Early-Data Experimental
    23. ECT Experimental
    24. Expect-CT Deprecated
    25. Host
    26. If-Range
    27. Link
    28. NEL Experimental
    29. No-Vary-Search Experimental
    30. Observe-Browsing-Topics Experimental Non-standard
    31. Origin-Agent-Cluster Experimental
    32. Permissions-Policy Experimental
    33. Pragma Deprecated
    34. Proxy-Authenticate
    35. Referrer-Policy
    36. Report-To Non-standard Deprecated
    37. Reporting-Endpoints Experimental
    38. RTT Experimental
    39. Save-Data Experimental
    40. Sec-Browsing-Topics Experimental Non-standard
    41. Sec-CH-Prefers-Color-Scheme Experimental
    42. Sec-CH-Prefers-Reduced-Motion Experimental
    43. Sec-CH-Prefers-Reduced-Transparency Experimental
    44. Sec-CH-UA Experimental
    45. Sec-CH-UA-Arch Experimental
    46. Sec-CH-UA-Bitness Experimental
    47. Sec-CH-UA-Form-Factors Experimental
    48. Sec-CH-UA-Full-Version Deprecated
    49. Sec-CH-UA-Full-Version-List Experimental
    50. Sec-CH-UA-Mobile Experimental
    51. Sec-CH-UA-Model Experimental
    52. Sec-CH-UA-Platform Experimental
    53. Sec-CH-UA-Platform-Version Experimental
    54. Sec-CH-UA-WoW64 Experimental
    55. Sec-Fetch-User
    56. Sec-GPC Experimental
    57. Sec-WebSocket-Key
    58. Server-Timing
    59. Set-Cookie
    60. Set-Login Experimental
    61. Speculation-Rules Experimental
    62. Supports-Loading-Mode Experimental
    63. Tk Non-standard Deprecated
    64. Upgrade-Insecure-Requests
    65. Viewport-Width Non-standard Deprecated
    66. Warning Deprecated
    67. Width Non-standard Deprecated
    68. X-DNS-Prefetch-Control Non-standard
    69. X-Forwarded-For Non-standard
    70. X-Forwarded-Host Non-standard
    71. X-Forwarded-Proto Non-standard
    72. X-Permitted-Cross-Domain-Policies Non-standard
    73. X-Powered-By Non-standard
    74. X-Robots-Tag Non-standard
    75. X-XSS-Protection Non-standard Deprecated
  • GET
  • POST
  • 100 Continue
  • 200 OK
  • 204 No Content
  • 208 Already Reported
  • 302 Found
  • 308 Permanent Redirect
  • 403 Forbidden
  • 407 Proxy Authentication Required
  • 411 Length Required
  • 415 Unsupported Media Type
  • 421 Misdirected Request
  • 425 Too Early
  • 431 Request Header Fields Too Large
  • 502 Bad Gateway
  • 506 Variant Also Negotiates
  • 511 Network Authentication Required
  • CSP: block-all-mixed-content Deprecated
  • CSP: fenced-frame-src Experimental
  • CSP: frame-src
  • CSP: object-src
  • CSP: prefetch-src Non-standard Deprecated
  • CSP: report-uri Deprecated
  • CSP: script-src-attr
  • CSP: style-src-elem
  • Permissions-Policy directives Experimental
    1. Permissions-Policy: accelerometer Experimental
    2. Permissions-Policy: ambient-light-sensor Experimental
    3. Permissions-Policy: attribution-reporting Experimental
    4. Permissions-Policy: autoplay Experimental
    5. Permissions-Policy: bluetooth Experimental
    6. Permissions-Policy: browsing-topics Experimental Non-standard
    7. Permissions-Policy: camera Experimental
    8. Permissions-Policy: compute-pressure Experimental
    9. Permissions-Policy: cross-origin-isolated Experimental
    10. Permissions-Policy: display-capture Experimental
    11. Permissions-Policy: document-domain Experimental
    12. Permissions-Policy: encrypted-media Experimental
    13. Permissions-Policy: fullscreen Experimental
    14. Permissions-Policy: gamepad Experimental
    15. Permissions-Policy: geolocation Experimental
    16. Permissions-Policy: gyroscope Experimental
    17. Permissions-Policy: hid Experimental
    18. Permissions-Policy: identity-credentials-get Experimental
    19. Permissions-Policy: idle-detection Experimental
    20. Permissions-Policy: local-fonts Experimental
    21. Permissions-Policy: magnetometer Experimental
    22. Permissions-Policy: microphone Experimental
    23. Permissions-Policy: midi Experimental
    24. Permissions-Policy: otp-credentials Experimental
    25. Permissions-Policy: payment Experimental
    26. Permissions-Policy: picture-in-picture Experimental
    27. Permissions-Policy: publickey-credentials-create Experimental
    28. Permissions-Policy: publickey-credentials-get Experimental
    29. Permissions-Policy: screen-wake-lock Experimental
    30. Permissions-Policy: serial Experimental
    31. Permissions-Policy: speaker-selection Experimental
    32. Permissions-Policy: storage-access Experimental
    33. Permissions-Policy: usb Experimental
    34. Permissions-Policy: web-share Experimental
    35. Permissions-Policy: window-management Experimental
    36. Permissions-Policy: xr-spatial-tracking Experimental
  • request header indicates the part of a resource that the server should return. Several parts can be requested at the same time in one Range header, and the server may send back these ranges in a multipart document. If the server sends back ranges, it uses the 206 Partial Content status code for the response. If the ranges are invalid, the server returns the 416 Range Not Satisfiable error.

    A server that doesn't support range requests may ignore the Range header and return the whole resource with a 200 status code. Older browsers used a response header of Accept-Ranges: none to disable features like 'pause' or 'resume' in download managers, but since a server ignoring the Range header has the same meaning as responding with Accept-Ranges: none, the header is rarely used in this way.

    Currently only bytes units are registered which are offsets (zero-indexed & inclusive). If the requested data has a content coding applied, each byte range represents the encoded sequence of bytes, not the bytes that would be obtained after decoding.

    The header is a CORS-safelisted request header when the directive specifies a single byte range.

    Header type Request header
    Forbidden request header No
  • Syntax

    http
    Range: <unit>=<range-start>-
    Range: <unit>=<range-start>-<range-end>
    Range: <unit>=<range-start>-<range-end>, …, <range-startN>-<range-endN>
    Range: <unit>=-<suffix-length>
    

    Directives

    <unit>

    The unit in which ranges are defined. Currently only bytes are a registered unit.

    <range-start>

    An integer in the given unit indicating the start position of the request range.

    <range-end>

    An integer in the given unit indicating the end position of the requested range. This value is optional and, if omitted, the end of the resource is used as the end of the range.

    <suffix-length>

    An integer indicating the number of units at the end of the resource to return.

    Examples

    The following examples show how to make requests using the Range header for CORS-safelisted requests, and for requesting multiple ranges. Other examples can be found in the CORS-safelisted request header when the value is a single byte range. This means that it can be used in cross-origin requests without triggering a preflight request, which is useful for requesting media and resuming downloads.

    The following example requests the first 500 bytes of a resource:

    http
    Range: bytes=0-499
    

    To request the second 500 bytes:

    http
    Range: bytes=500-999
    

    Omitting the end position requests all remaining units of the resource, so the last 100 bytes of a resource with a length of 1000 bytes can be requested using:

    http
    Range: bytes=900-
    

    Alternatively, if it's unknown how large a resource is, the last n bytes can be requested using a suffix range of -n:

    http
    Range: bytes=-100
    

    Requesting multiple ranges

    Given a resource with a length of 10000 bytes, the following example requests three separate ranges; 200-999 (800 bytes), 2000-2499 (500 bytes), and finally 9500-. The ranges-specifier value 9500- omits an end position which indicates that all bytes from 9500 onward are part of the third range (500 bytes).

    http
    Range: bytes=200-999, 2000-2499, 9500-
    

    This example requests the first 500 and last 500 bytes of the file. The request may be rejected by the server if these ranges overlap (if the requested resource was less than 1000 bytes long, for instance).

    http
    Range: bytes=0-499, -500
    

    Checking if a server supports range requests

    The following curl command makes a HEAD request for an image:

    bash
    curl -v --http1.1 -I https://i.imgur.com/z4d4kWk.jpg
    # or using the OPTIONS method:
    # curl -v --http1.1 -X OPTIONS https://i.imgur.com/z4d4kWk.jpg
    

    This results in the following HTTP request:

    http
    HEAD /z4d4kWk.jpg HTTP/1.1
    Host: i.imgur.com
    User-Agent: curl/8.7.1
    Accept: */*
    

    The server responds with a 200 response, and the Accept-Ranges: bytes header is present (some headers are omitted for brevity):

    http
    HTTP/1.1 200 OK
    Connection: keep-alive
    Content-Length: 146515
    Content-Type: image/jpeg
    …
    Accept-Ranges: bytes
    

    Specifications

    Specification
    HTTP Semantics
    # field.range

    Browser compatibility

    See also