The toy Range example keeps its boundary narrow.
What this toy model checks
The trust boundary parses one GET request, one pinned resource, one Range span, and one partial response.
recompute range slice \text{recompute range slice} recompute range slice Range honesty boundary The selected slice, Content-Range header, body bytes, and length checks are recomputed from pinned bytes. Range honesty boundary - GET /file.txt bytes 2-5 -> cdef (4 bytes) section name value check request line method GET parsed request line path /file.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Range bytes=2-5 requested slice resource display abcdefgh safe display form resource exact hex 6162636465666768 pinned bytes resource byte length 8 counted range start 2 inclusive range end 5 inclusive range offsets 2,3,4,5 selected slice display c d e f safe display form slice exact hex 63646566 pinned bytes slice byte length 4 counted status version HTTP/1.1 parsed status status 206 Partial Content partial content header Content-Range bytes 2-5/8 slice over total header Content-Length 4 declared bytes body display cdef safe display form body exact hex 63646566 pinned bytes check range bytes 2-5 request check covered bytes 4 inclusive count check total length 8 Content-Range check Content-Length 4 selected body check match yes all counts agree
Honesty boundary
NOTE: toy HTTP Range response only; not multiple ranges, suffix ranges, unsatisfied ranges, cache validators, compression, streaming, chunked transfer, content encoding, media seeking, authorization, proxies, HTTP/2 or HTTP/3, frameworks, or production server config.
toy Range only \text{toy Range only} toy Range only Range honesty boundary The selected slice, Content-Range header, body bytes, and length checks are recomputed from pinned bytes. Range honesty boundary - GET /file.txt bytes 2-5 -> cdef (4 bytes) section name value check request line method GET parsed request line path /file.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Range bytes=2-5 requested slice resource display abcdefgh safe display form resource exact hex 6162636465666768 pinned bytes resource byte length 8 counted range start 2 inclusive range end 5 inclusive range offsets 2,3,4,5 selected slice display c d e f safe display form slice exact hex 63646566 pinned bytes slice byte length 4 counted status version HTTP/1.1 parsed status status 206 Partial Content partial content header Content-Range bytes 2-5/8 slice over total header Content-Length 4 declared bytes body display cdef safe display form body exact hex 63646566 pinned bytes check range bytes 2-5 request check covered bytes 4 inclusive count check total length 8 Content-Range check Content-Length 4 selected body check match yes all counts agree
No client compute
The page shows already validated rows. It does not slice bytes in browser code.
static validated rows \text{static validated rows} static validated rows Range honesty boundary The selected slice, Content-Range header, body bytes, and length checks are recomputed from pinned bytes. Range honesty boundary - GET /file.txt bytes 2-5 -> cdef (4 bytes) section name value check request line method GET parsed request line path /file.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Range bytes=2-5 requested slice resource display abcdefgh safe display form resource exact hex 6162636465666768 pinned bytes resource byte length 8 counted range start 2 inclusive range end 5 inclusive range offsets 2,3,4,5 selected slice display c d e f safe display form slice exact hex 63646566 pinned bytes slice byte length 4 counted status version HTTP/1.1 parsed status status 206 Partial Content partial content header Content-Range bytes 2-5/8 slice over total header Content-Length 4 declared bytes body display cdef safe display form body exact hex 63646566 pinned bytes check range bytes 2-5 request check covered bytes 4 inclusive count check total length 8 Content-Range check Content-Length 4 selected body check match yes all counts agree
Summary
A Range header can ask for exact byte positions, and the response can carry only those bytes.
Range picks bytes \text{Range picks bytes} Range picks bytes Range honesty boundary The selected slice, Content-Range header, body bytes, and length checks are recomputed from pinned bytes. Range honesty boundary - GET /file.txt bytes 2-5 -> cdef (4 bytes) section name value check request line method GET parsed request line path /file.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Range bytes=2-5 requested slice resource display abcdefgh safe display form resource exact hex 6162636465666768 pinned bytes resource byte length 8 counted range start 2 inclusive range end 5 inclusive range offsets 2,3,4,5 selected slice display c d e f safe display form slice exact hex 63646566 pinned bytes slice byte length 4 counted status version HTTP/1.1 parsed status status 206 Partial Content partial content header Content-Range bytes 2-5/8 slice over total header Content-Length 4 declared bytes body display cdef safe display form body exact hex 63646566 pinned bytes check range bytes 2-5 request check covered bytes 4 inclusive count check total length 8 Content-Range check Content-Length 4 selected body check match yes all counts agree