Should we block HTTP range requests?

[jonpmoore]

I have found a few short discussions about how to block range requests, and an article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJsCAK.

My question is whether we should be blocking them because they present a threat.

My understanding is that an HTTP response is scanned in a single pass as it streams through the firewall, and that the most fundamental operation is looking for patterns within the content which indicate a problem with the content.  Is it therefore possible for a pattern to be split across the boundary between two HTTP range requests, and not detected?  Particularly since the range requests could be submitted multi-threaded, and therefore the later part of the file is actually processed before the earlier part?

Essentially: if a file is downloaded by a series of HTTP range requests, possibly not in the natural order, then are we guaranteed the same level of protection as if the file were downloaded using a single request?

Any links to definitive product documentation on this would be very welcome.

[JayGolf]

Hi @jonpmoore ,

Here is a relevant KB regarding HTTP range requests. In my opinion, if you aren't experiencing specific issues then it should be set to block.