Fastly returns 206 response instead of 416

[jpalus]

Current Behavior

I'm already aware of #2771 as well as rust-lang/cargo#8647 but I think this issue is somewhat different.

Trying to resume download of already fully retrieved crate tarball:

1. Returns code 206
2. content-range header is completely wrong (ie content-range: bytes 278076-278075/278076 start of range is after end of range!)

Expected Behavior

If file is fully retrieved and requested range is past end of target file then I'd expect response 416 Requested Range Not Satisfiable

Steps To Reproduce

1. Download crate tarball:

$ curl -L -o syn.tgz https://crates.io/api/v1/crates/syn/2.0.87/download # equivalent to wget -O syn.tgz <url>

2. Try to resume download ie to make sure previous download was not interrupted with Range: starting at the current size of syn.tgz:

$ curl -vL -r `du -b syn.tgz | cut -f1`- -o syn.tgz https://crates.io/api/v1/crates/syn/2.0.87/download # equivalent of wget -c -O syn.tgz <url>

Environment

N/A

Anything else?

I do realize it's an issue in AWS but sadly I don't have any point of contact there so I'm hoping you can help out :)

[jpalus]

The consequence of this issue, that affects me in one of the use cases most, is that wget -c goes into infinite loop due to misbehaving AWS.

[Turbo87]

@rust-lang/infra 💁‍♂️

[Mark-Simulacrum]

Can we confirm this is cloudfront and not fastly? It would be good to get the -vv output from curl (all request + response headers) so we have the data center affected as well, in case it's not all of them.

[jpalus]

Did you mean -v which already includes all headers or you'd really want -vv which seems to include way more? I can provide both but for the time being here's output with -v (HTTP/2 is negotiated, but it works the same way with HTTP/1.1):

Initial download

$ curl -svL -o syn.tgz https://crates.io/api/v1/crates/syn/2.0.1/download
* Host crates.io:443 was resolved.
* IPv6: 2600:9000:290c:9a00:c:7ed3:240:93a1, 2600:9000:290c:7c00:c:7ed3:240:93a1, 2600:9000:290c:5000:c:7ed3:240:93a1, 2600:9000:290c:7200:c:7ed3:240:93a1, 2600:9000:290c:c400:c:7ed3:240:93a1, 2600:9000:290c:400:c:7ed3:240:93a1, 2600:9000:290c:4000:c:7ed3:240:93a1, 2600:9000:290c:6a00:c:7ed3:240:93a1
* IPv4: 151.101.130.137, 151.101.194.137, 151.101.2.137, 151.101.66.137
*   Trying [2600:9000:290c:9a00:c:7ed3:240:93a1]:443...
* connect to 2600:9000:290c:9a00:c:7ed3:240:93a1 port 443 from fd00::d434:e9ff:fe06:41b7 port 34852 failed: Network is unreachable
*   Trying 151.101.130.137:443...
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1564 bytes data]
* SSL Trust Anchors:
*   CAfile: /etc/certs/ca-certificates.crt
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2838 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=crates.io
*   start date: Jan 15 15:26:59 2026 GMT
*   expire date: Feb 16 15:26:58 2027 GMT
*   issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "crates.io" matches cert's "crates.io"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to crates.io (151.101.130.137 port 443) from 10.0.2.100 port 55748 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://crates.io/api/v1/crates/syn/2.0.1/download
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: crates.io]
* [HTTP/2] [1] [:path: /api/v1/crates/syn/2.0.1/download]
* [HTTP/2] [1] [user-agent: curl/8.19.0]
* [HTTP/2] [1] [accept: */*]
} [5 bytes data]
> GET /api/v1/crates/syn/2.0.1/download HTTP/2
> Host: crates.io
> User-Agent: curl/8.19.0
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [193 bytes data]
< HTTP/2 302 
< reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=%2BD7W%2Fqn4pYHVWTm1%2Bp1mmtw7tGiNmPLyn3q6%2B93a%2F50%3D&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&ts=1773396743"
< access-control-allow-origin: *
< server: Heroku
< report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=%2BD7W%2Fqn4pYHVWTm1%2Bp1mmtw7tGiNmPLyn3q6%2B93a%2F50%3D\u0026sid=af571f24-03ee-46d1-9f90-ab9030c2c74c\u0026ts=1773396743"}],"max_age":3600}
< location: https://static.crates.io/crates/syn/syn-2.0.1.crate
< nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
< via: 1.1 heroku-router, 1.1 varnish
< accept-ranges: bytes
< date: Fri, 13 Mar 2026 10:12:23 GMT
< x-served-by: cache-vie6382-VIE, cache-vie6367-VIE
< x-cache: MISS, MISS
< x-cache-hits: 0, 0
< x-timer: S1773396743.079239,VS0,VE134
< strict-transport-security: max-age=31536000; includeSubDomains
< content-length: 0
* Ignoring the response-body
* setting size while ignoring
< 
* Connection #0 to host crates.io:443 left intact
* Issue another request to this URL: 'https://static.crates.io/crates/syn/syn-2.0.1.crate'
* Host static.crates.io:443 was resolved.
* IPv6: 2a04:4e42:41::649
* IPv4: 199.232.18.137
*   Trying [2a04:4e42:41::649]:443...
* connect to 2a04:4e42:41::649 port 443 from fd00::d434:e9ff:fe06:41b7 port 39750 failed: Network is unreachable
*   Trying 199.232.18.137:443...
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1571 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2853 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=static.crates.io
*   start date: Sep  3 10:30:16 2025 GMT
*   expire date: Oct  5 10:30:15 2026 GMT
*   issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Atlas R3 DV TLS CA 2025 Q3
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "static.crates.io" matches cert's "static.crates.io"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to static.crates.io (199.232.18.137 port 443) from 10.0.2.100 port 45882 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://static.crates.io/crates/syn/syn-2.0.1.crate
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: static.crates.io]
* [HTTP/2] [1] [:path: /crates/syn/syn-2.0.1.crate]
* [HTTP/2] [1] [user-agent: curl/8.19.0]
* [HTTP/2] [1] [accept: */*]
} [5 bytes data]
> GET /crates/syn/syn-2.0.1.crate HTTP/2
> Host: static.crates.io
> User-Agent: curl/8.19.0
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [193 bytes data]
< HTTP/2 200 
< x-amz-version-id: eyFuoQw91.Crtpgz7Qe0PUO0d95ksb75
< x-amz-id-2: ERM9tDAAHs6Y+hdWvylVIGeIQeQ7aVqiSvJQuETbZ2FUkscHu3NIXHyzBZZyEwvz/f1zKcusyUA=
< x-amz-request-id: E6EWB4EFBPMV4D4K
< date: Thu, 12 Mar 2026 12:58:41 GMT
< x-amz-replication-status: COMPLETED
< last-modified: Sat, 18 Mar 2023 21:22:48 GMT
< x-amz-server-side-encryption: AES256
< etag: "754c03a5531fd21b0505ce90dadc8caf"
< cache-control: public,max-age=31536000,immutable
< accept-ranges: bytes
< content-type: application/gzip
< x-served-by: cache-vie6381-VIE
< server: AmazonS3
< age: 76424
< x-cache: HIT
< x-cache-hits: 2
< content-length: 240031
< 
{ [5 bytes data]
* Connection #1 to host static.crates.io:443 left intact

Resume

$ curl -svL -r `du -b syn.tgz | cut -f1`- -o syn.tgz https://crates.io/api/v1/crates/syn/2.0.1/download
* Host crates.io:443 was resolved.
* IPv6: 2600:9000:290c:6a00:c:7ed3:240:93a1, 2600:9000:290c:9a00:c:7ed3:240:93a1, 2600:9000:290c:7c00:c:7ed3:240:93a1, 2600:9000:290c:5000:c:7ed3:240:93a1, 2600:9000:290c:7200:c:7ed3:240:93a1, 2600:9000:290c:c400:c:7ed3:240:93a1, 2600:9000:290c:400:c:7ed3:240:93a1, 2600:9000:290c:4000:c:7ed3:240:93a1
* IPv4: 151.101.194.137, 151.101.2.137, 151.101.66.137, 151.101.130.137
*   Trying [2600:9000:290c:6a00:c:7ed3:240:93a1]:443...
* connect to 2600:9000:290c:6a00:c:7ed3:240:93a1 port 443 from fd00::d434:e9ff:fe06:41b7 port 53182 failed: Network is unreachable
*   Trying 151.101.194.137:443...
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1564 bytes data]
* SSL Trust Anchors:
*   CAfile: /etc/certs/ca-certificates.crt
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2838 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=crates.io
*   start date: Jan 15 15:26:59 2026 GMT
*   expire date: Feb 16 15:26:58 2027 GMT
*   issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "crates.io" matches cert's "crates.io"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to crates.io (151.101.194.137 port 443) from 10.0.2.100 port 51864 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://crates.io/api/v1/crates/syn/2.0.1/download
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: crates.io]
* [HTTP/2] [1] [:path: /api/v1/crates/syn/2.0.1/download]
* [HTTP/2] [1] [range: bytes=240031-]
* [HTTP/2] [1] [user-agent: curl/8.19.0]
* [HTTP/2] [1] [accept: */*]
} [5 bytes data]
> GET /api/v1/crates/syn/2.0.1/download HTTP/2
> Host: crates.io
> Range: bytes=240031-
> User-Agent: curl/8.19.0
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [193 bytes data]
< HTTP/2 302 
< reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=HScK76uagRXEU78AQZNEbapm3N%2FKTNQfm45QgdG71sY%3D&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&ts=1773396760"
< access-control-allow-origin: *
< server: Heroku
< report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=HScK76uagRXEU78AQZNEbapm3N%2FKTNQfm45QgdG71sY%3D\u0026sid=af571f24-03ee-46d1-9f90-ab9030c2c74c\u0026ts=1773396760"}],"max_age":3600}
< location: https://static.crates.io/crates/syn/syn-2.0.1.crate
< nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
< via: 1.1 heroku-router, 1.1 varnish
< accept-ranges: bytes
< date: Fri, 13 Mar 2026 10:12:40 GMT
< x-served-by: cache-vie6353-VIE, cache-vie6334-VIE
< x-cache: MISS, MISS
< x-cache-hits: 0, 0
< x-timer: S1773396760.250795,VS0,VE478
< strict-transport-security: max-age=31536000; includeSubDomains
< content-length: 0
* Ignoring the response-body
* setting size while ignoring
< 
* Connection #0 to host crates.io:443 left intact
* Issue another request to this URL: 'https://static.crates.io/crates/syn/syn-2.0.1.crate'
* Host static.crates.io:443 was resolved.
* IPv6: 2a04:4e42:41::649
* IPv4: 199.232.18.137
*   Trying [2a04:4e42:41::649]:443...
* connect to 2a04:4e42:41::649 port 443 from fd00::d434:e9ff:fe06:41b7 port 44098 failed: Network is unreachable
*   Trying 199.232.18.137:443...
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1571 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2853 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=static.crates.io
*   start date: Sep  3 10:30:16 2025 GMT
*   expire date: Oct  5 10:30:15 2026 GMT
*   issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Atlas R3 DV TLS CA 2025 Q3
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "static.crates.io" matches cert's "static.crates.io"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to static.crates.io (199.232.18.137 port 443) from 10.0.2.100 port 34740 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://static.crates.io/crates/syn/syn-2.0.1.crate
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: static.crates.io]
* [HTTP/2] [1] [:path: /crates/syn/syn-2.0.1.crate]
* [HTTP/2] [1] [range: bytes=240031-]
* [HTTP/2] [1] [user-agent: curl/8.19.0]
* [HTTP/2] [1] [accept: */*]
} [5 bytes data]
> GET /crates/syn/syn-2.0.1.crate HTTP/2
> Host: static.crates.io
> Range: bytes=240031-
> User-Agent: curl/8.19.0
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [193 bytes data]
< HTTP/2 206 
< x-amz-version-id: eyFuoQw91.Crtpgz7Qe0PUO0d95ksb75
< x-amz-id-2: ERM9tDAAHs6Y+hdWvylVIGeIQeQ7aVqiSvJQuETbZ2FUkscHu3NIXHyzBZZyEwvz/f1zKcusyUA=
< x-amz-request-id: E6EWB4EFBPMV4D4K
< date: Thu, 12 Mar 2026 12:58:41 GMT
< x-amz-replication-status: COMPLETED
< last-modified: Sat, 18 Mar 2023 21:22:48 GMT
< x-amz-server-side-encryption: AES256
< etag: "754c03a5531fd21b0505ce90dadc8caf"
< cache-control: public,max-age=31536000,immutable
< accept-ranges: bytes
< content-type: application/gzip
< x-served-by: cache-vie6335-VIE
< server: AmazonS3
< age: 76441
< content-range: bytes 240031-240030/240031
< x-cache: HIT
< x-cache-hits: 3
< content-length: 240031
< 
{ [947 bytes data]
* Connection #1 to host static.crates.io:443 left intact

[Mark-Simulacrum]

Those look like responses from Fastly - I'm not seeing the x-amz-cf-{pop,id} headers that a CloudFront/AWS response would set. We should reach out to them if we need help (I think we have a closer relationship there right now).