mozilla/pdf.js · error · Error

Expected range response-origin "${rangeOrigin}" to match "${

Error message

Expected range response-origin "${rangeOrigin}" to match "${origin}".

What it means

Thrown by ensureResponseOrigin in network_utils when the origin reported by a range (partial-content) response does not equal the origin of the original document request. PDF.js uses this as a security check so that a redirect or cross-origin swap mid-stream cannot feed bytes from an untrusted origin into the PDF fetch. The check is string-equality on URL origins.

Source

Thrown at src/display/network_utils.js:119

    }
    if (isPdfFile(filename)) {
      return filename;
    }
  }
  return null;
}

function createResponseError(status, url) {
  return new ResponseException(
    `Unexpected server response (${status}) while retrieving PDF "${url.href}".`,
    status,
    /* missing = */ status === 404 || (status === 0 && url.protocol === "file:")
  );
}

function ensureResponseOrigin(rangeOrigin, origin) {
  if (rangeOrigin !== origin) {
    throw new Error(
      `Expected range response-origin "${rangeOrigin}" to match "${origin}".`
    );
  }
}

export {
  createHeaders,
  createResponseError,
  ensureResponseOrigin,
  extractFilenameFromHeader,
  getResponseOrigin,
  trimHeadersEnd,
  validateRangeRequestCapabilities,
};

View on GitHub (pinned to 5903d58d58)

Solutions

1. Serve the PDF and its range endpoint from the same origin, or ensure redirects preserve the origin.
2. Configure the server/CDN to send proper CORS headers (Access-Control-Allow-Origin) and avoid cross-origin redirects for range requests.
3. If cross-origin is intentional, fetch via a same-origin proxy that streams the bytes.
4. Disable range requests (set disableRange / a small rangeChunkSize) so the check is not exercised.

const docOrigin = new URL(pdfUrl).origin;
const isCrossOrigin = docOrigin !== self.origin;
getDocument({ url: pdfUrl, disableRange: isCrossOrigin });

function isSameOriginRangeSafe(pdfUrl, knownOrigin) {
  try { return new URL(pdfUrl).origin === knownOrigin; } catch { return false; }
}

try {
  await getDocument({ url: pdfUrl }).promise;
} catch (e) {
  if (e.message.includes('range response-origin')) {
    // retry with disableRange: true or via a same-origin proxy
  }
}

When it happens

Trigger: A streaming/range PDF request is issued; the range response's origin (getResponseOrigin of the range URL) differs from the origin captured at the start of the fetch.

Common situations: The PDF is served behind a reverse proxy/CDN that redirects range requests to a different host; CORS is misconfigured so the range endpoint resolves to a cross-origin; a signed-URL provider issues per-request origins; a 'null' origin (file: or sandboxed iframe) is compared against an 'https' origin.

Related errors

• Bad begin offset: ${begin}
• Bad end offset: ${end}
• Failed to fetch file "${url}" with "${response.statusText}".
• Unable to load ${this.#errorStr[kind]} data at: ${url}
• The PDF file is empty, i.e. its size is zero bytes.

AI-assisted analysis of mozilla/pdf.js@5903d58d58 (2026-08-13). Data as JSON: /api/errors/f68cc764b8d6ad42. Report an issue: GitHub.