How to Validate HTTP Range Requests and Resumable Downloads Through a Proxy

HTTP Range requests make large downloads, media verification and interrupted data collection more efficient. They also create correctness risks. A proxy route may ignore the requested range, cache the wrong segment, return inconsistent validators or change exit IP between parts. A downloader can then assemble a file that has the right size but the wrong bytes.

This guide builds a controlled Range and resume test for proxy buyers. Use only files and endpoints you own or are authorized to test.

Define the expected contract

For a single byte range, the origin should normally return 206 Partial Content, a valid Content-Range, the correct segment length and stable representation validators. If the origin ignores Range, it may return the complete representation with 200. The client must distinguish those outcomes rather than appending a full response to a partial file.

Record:

test_id
route_alias
range_requested
status
content_range
content_length
etag_hash
last_modified
segment_digest
full_object_digest
proxy_session_id_hash
failure_phase

Never log proxy passwords, authorization headers, cookies or raw session tokens.

Build a deterministic fixture

Create an owned binary object with known bytes and a strong full-file digest. Make the content large enough to span multiple segments, and place distinctive patterns at every boundary. Publish stable ETag, Last-Modified, Accept-Ranges and length metadata.

Create a second version with the same approximate size but different boundary bytes. This lets you test whether a resume crosses an object change safely.

Test the direct baseline

Before adding a proxy, request:

• the first byte;
• a middle interval;
• the final byte;
• an open-ended range;
• a suffix range;
• an unsatisfiable range;
• two adjacent ranges that reconstruct one larger interval.

Verify status, range boundaries, exact length and segment digest. For an unsatisfiable request, confirm the response identifies the current total length without returning a plausible partial body.

Run a proxy route matrix

Keep object version, range, client and timeout constant. Repeat every segment through each route. A rotating proxy may legitimately change exits, but every part still needs to refer to the same object representation.

Validate Content-Range mathematically

For bytes start-end/total, require:

• start is not greater than end;
• returned length equals end minus start plus one;
• end is smaller than total;
• body bytes match the requested portion of the owned fixture;
• all segments in one assembly share the same strong validator.

Reject overlapping segments with different bytes, unexpected gaps and totals that change mid-download. Never infer correctness only from Content-Length.

Protect resume with validators

When resuming, send an appropriate validator so the server does not append bytes from a new object version to an old partial file. If the validator no longer matches, restart from a clean temporary file. Do not overwrite the verified destination until the full object digest succeeds.

Treat weak and strong validators differently. If your workflow cannot prove that two partial responses represent identical bytes, it should restart rather than guess.

Separate compression from byte ranges

Ranges apply to a selected representation. Automatic compression can change byte offsets, lengths and validators. Start with identity encoding to establish byte-level correctness. Test compressed representations only when the origin contract is explicit and the client records whether offsets refer to encoded or decoded bytes.

Use the gzip and Brotli integrity test before combining compression with resume logic.

Test failure and retry paths

Interrupt the connection after a known number of bytes, then resume. Test a timeout before headers, during a segment and after the final segment but before commit. Record whether a retry opens a new tunnel or changes proxy exit.

A partial GET is often safe to retry, but the client must write to an offset-aware temporary file. Never append blindly. Bound retries and total elapsed time with the proxy retry-storm prevention guide.

Detect cache and route contamination

Use unique challenge parameters on an authorized fixture to separate cache misses from controlled hits. Compare response validators and segment digests across gateways. A cache must not serve a segment from version A under version B's validator.

Do not bypass third-party cache policy. Cache tests belong on your own origin or an explicitly permitted environment.

Measure useful performance

Track time to first byte, segment throughput, resume success rate, bytes redownloaded, complete-file success rate and cost per verified object. A route with high raw throughput can still be expensive if invalid segments force repeated full downloads.

Combine results with bandwidth cost estimation and cost per successful request.

Release checklist

• Direct first, middle, last, suffix and invalid ranges pass.
• Every 206 response has valid mathematical boundaries.
• Segment digests match the owned fixture.
• One assembly never mixes validators.
• Object changes trigger a clean restart.
• Identity encoding passes before compressed testing.
• Interrupted transfers resume into temporary files.
• Final files are committed only after full digest success.
• IPv4, IPv6, gateway and session results are separate.
• Logs contain no credentials or private payloads.

FAQ

Is a 200 response to a Range request always an error?

No. A server may ignore Range and return the complete object. The client must replace or restart, not append it to partial bytes.

Can segments use different proxy exits?

They can if the origin permits it and validators prove the representation is identical. Sticky sessions are safer when access state or geo-specific content can vary.

Is matching total size enough?

No. Wrong or duplicated segments can preserve total size. Verify every segment and the final full-object digest.

Should parallel ranges be used immediately?

First prove sequential correctness. Add bounded parallelism only after the route, origin and cache behavior are stable.

Compliance note

Request ranges only from systems and objects you own or are authorized to access. Respect rate limits, licensing, cache rules and privacy requirements. Do not use segmented downloads to evade access controls or traffic limits.