{"record":{"id":"f68cc764b8d6ad42","repo":"mozilla/pdf.js","slug":"expected-range-response-origin-rangeorigin-to","errorCode":null,"errorMessage":"Expected range response-origin \"${rangeOrigin}\" to match \"${origin}\".","messagePattern":"Expected range response-origin \"(.+?)\" to match \"(.+?)\"\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/display/network_utils.js","lineNumber":119,"sourceCode":"    }\n    if (isPdfFile(filename)) {\n      return filename;\n    }\n  }\n  return null;\n}\n\nfunction createResponseError(status, url) {\n  return new ResponseException(\n    `Unexpected server response (${status}) while retrieving PDF \"${url.href}\".`,\n    status,\n    /* missing = */ status === 404 || (status === 0 && url.protocol === \"file:\")\n  );\n}\n\nfunction ensureResponseOrigin(rangeOrigin, origin) {\n  if (rangeOrigin !== origin) {\n    throw new Error(\n      `Expected range response-origin \"${rangeOrigin}\" to match \"${origin}\".`\n    );\n  }\n}\n\nexport {\n  createHeaders,\n  createResponseError,\n  ensureResponseOrigin,\n  extractFilenameFromHeader,\n  getResponseOrigin,\n  trimHeadersEnd,\n  validateRangeRequestCapabilities,\n};\n","sourceCodeStart":101,"sourceCodeEnd":134,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/src/display/network_utils.js#L101-L134","documentation":"Thrown by ensureResponseOrigin in network_utils when the origin reported by a range (partial-content) response does not equal the origin of the original document request. PDF.js uses this as a security check so that a redirect or cross-origin swap mid-stream cannot feed bytes from an untrusted origin into the PDF fetch. The check is string-equality on URL origins.","triggerScenarios":"A streaming/range PDF request is issued; the range response's origin (getResponseOrigin of the range URL) differs from the origin captured at the start of the fetch.","commonSituations":"The PDF is served behind a reverse proxy/CDN that redirects range requests to a different host; CORS is misconfigured so the range endpoint resolves to a cross-origin; a signed-URL provider issues per-request origins; a 'null' origin (file: or sandboxed iframe) is compared against an 'https' origin.","solutions":["Serve the PDF and its range endpoint from the same origin, or ensure redirects preserve the origin.","Configure the server/CDN to send proper CORS headers (Access-Control-Allow-Origin) and avoid cross-origin redirects for range requests.","If cross-origin is intentional, fetch via a same-origin proxy that streams the bytes.","Disable range requests (set disableRange / a small rangeChunkSize) so the check is not exercised."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const docOrigin = new URL(pdfUrl).origin;\nconst isCrossOrigin = docOrigin !== self.origin;\ngetDocument({ url: pdfUrl, disableRange: isCrossOrigin });","typeGuard":"function isSameOriginRangeSafe(pdfUrl, knownOrigin) {\n  try { return new URL(pdfUrl).origin === knownOrigin; } catch { return false; }\n}","tryCatchPattern":"try {\n  await getDocument({ url: pdfUrl }).promise;\n} catch (e) {\n  if (e.message.includes('range response-origin')) {\n    // retry with disableRange: true or via a same-origin proxy\n  }\n}","preventionTips":["Serve PDFs and their range endpoints from one origin.","Avoid cross-origin redirects for range requests.","Set proper CORS headers if cross-origin fetching is unavoidable.","Use disableRange when you cannot guarantee origin stability."],"tags":["network","cors","range-request","security","streaming"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}