CODEWITHSUNDEEP
http-headersxmlhttprequestgoogle-cloud-storage
whadar
whadar

Reputation: 4481

Refused to get unsafe header "Content-Range"

For some reason I cannot access the response header of "Content-Range" anymore... Therefore it's impossible to determine the file size of a resource using XHR. I get error Refused to get unsafe header "Content-Range" on Chrome in this line:

var cr = this.getResponseHeader('Content-Range');

Here's the CORS config:

<?xml version="1.0" ?>
<CorsConfig>
<Cors>
    <Origins>
        <Origin>*</Origin>
    </Origins>
    <Methods>
        <Method>GET</Method>
        <Method>HEAD</Method>
        <Method>DELETE</Method>
    </Methods>
    <ResponseHeaders>
        <ResponseHeader>x-goog-meta-foo1</ResponseHeader>
        <ResponseHeader>origin</ResponseHeader>
        <ResponseHeader>range</ResponseHeader>
        <ResponseHeader>Content-Range</ResponseHeader>
        <ResponseHeader>Content-Length</ResponseHeader>
    </ResponseHeaders>
    <MaxAgeSec>1800</MaxAgeSec>
</Cors>

CURL output:

$ curl -H "Origin: http://peer5.com" http://commondatastorage.googleapis.com/peer5_vod/wind2_orig.mp4 -s -D - -o /dev/null
HTTP/1.1 200 OK
Server: HTTP Upload Server Built on May 8 2013 16:51:19 (1368057079)
Expires: Mon, 13 May 2013 09:47:40 GMT
Date: Mon, 13 May 2013 08:47:40 GMT
Cache-Control: public, max-age=3600, no-transform
Last-Modified: Fri, 22 Mar 2013 17:09:47 GMT
ETag: "755232ae8fef22bc7b4e9510a68a646e"
x-goog-generation: 1363972188238000
x-goog-metageneration: 2
Content-Type: video/mp4
x-goog-hash: crc32c=pZmS2Q==
x-goog-hash: md5=dVIyro/vIrx7TpUQpopkbg==
Accept-Ranges: bytes
Content-Length: 15535795
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Date, Server, Transfer-Encoding

Upvotes: 3

Views: 14688

Answers (1)

jterrace
jterrace

Reputation: 67073

This appears to be a bug on our side. Only the last header value in the ResponseHeaders list is returned in the Access-Control-Expose-Headers header. We are working on rolling out a fix, but as a workaround, if you only need the Content-Range header (Content-Length is considered a simple header by the CORS spec and is added automatically), please try setting your CORS config to this:

<?xml version="1.0" ?>
<CorsConfig>
<Cors>
    <Origins>
        <Origin>*</Origin>
    </Origins>
    <Methods>
        <Method>GET</Method>
        <Method>HEAD</Method>
        <Method>DELETE</Method>
    </Methods>
    <ResponseHeaders>
        <ResponseHeader>Content-Range</ResponseHeader>
    </ResponseHeaders>
    <MaxAgeSec>1800</MaxAgeSec>
</Cors>
</CorsConfig>

UPDATE: This bug has been fixed.

Upvotes: 8

Related Questions