Why is the 'Range' URLRequestHeader in Flash restricted?

Question

Can anyone tell me why the Range, header is restricted in the Flash player?

I want to be able to pause and resume downloads in my flex application, but I get a RTE when trying to set the Range header.

Error #2096: The HTTP request header Range cannot be set via ActionScript.

I imagine there isn't going to be a work around client side, but expect there is a way you can get a server to change the name for the range header to something else...

Would like to know Adobe's reason for this though, hopefully it's not just to sell more copies of FMS :p

Answer 1

I am not sure why the Range header is specifically disallowed, but it is. See Runtime Errors, code 2096. I had a similar problem before trying to set WWW-Authenticate, which it specifically disallows also.

Answer 2

Here are a couple of Adobe Tech Notes that explain their reasoning:

• Arbitrary headers are not sent from Flash Player to a remote domain
• ActionScript error when an HTTP send action contains certain headers (Flash Player)

Answer 3

I just discovered exactly the same issue with the Range header while attempting to add ranged GET requests to our REST layer in Flex. Range is on the "blacklist" and the Flash Player simply won't send it.

Flash/Flex headers ate my brain a year or so back (verveguy.blogspot.com) but this is the last straw.

The solution I am now going to finally embrace is to use the open source as3httpclientlib and just abandon the Flash HTTP stack. We've used it successfully for some minor parts of our app (specifically, for talking to the JIRA API) so it's time to beat it into submission for all HTTP traffic.

For your specific problem, you could certainly switch to a custom header, say X-Range. This assumes you have control of the server side code and that you also have a crossdomain.xml policy file that allows headers. (Blacklisted headers are the first set to be culled. After that, the Flash player checks the crossdomain.xml advertised by the server you're talking to see whether it allows specific (or all other) headers)

Hope this helps