HTTP partial response - Security protection bypass

DaMonk — Mon, 27 Jul 2026 04:27:59 GMT

The Palo Firewall supports HTTP partial response and is enabled by default, best practice is to disable HTTP partial response but this is a global setting. Doing so will break access to numerous internet based systems like youtube, and a number of other systems that utilise chuck encoding, including palo's own content updates.

When HTTP partial response is allowed, and a download is blocked due to file blocking policy, AV signature etc, and it is hosted on a site that supports resumption (which is very common these days), a user can simply select resume and the file will be downloaded, even more of an issue is lately I have seen browsers automatically resume downloads, and a number of other solutions will automatically resume a failed download

What is even worse is that the firewall logs will record the file was blocked, but not that the file was then successfully downloaded, so the logs are incorrect.

A feature request exists to either fix or enhance the ability to selectively block / allow HTTP partial response based on rule / content / application, something other than globally. NSFR-I-22821

When querying my account team about the traction of this request I have been advised it is still not on the roadmap as there has been little traction on it from other customer, even though the reality of it is the palo firewall is either not adequately able to enforce it's security policy or it is not able to provide access to many modern websites / streaming platforms or even it's own update service.

Please ask your account teams to vote for this feature request.

topic HTTP partial response - Security protection bypass in Next-Generation Firewall Discussions

HTTP partial response - Security protection bypass