mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-16 16:45:07 +00:00
Ignacio Nelson
9b265e3b87
An empty response gets Symfony's default Content-Type, text/html, and a CDN in front of the app takes that at its word: Cloudflare's Email Obfuscation and Automatic HTTPS Rewrites both rewrite HTML bodies, so they drop the origin's ETag from the response — a rewritten body would no longer match it. That ETag is the client's only signal that a part landed. Nothing on this side notices its loss, because LocalPartStore keeps its own record of every part and complete() never reads a client-supplied one; the upload simply reaches 100% and stops, with no error at either end. Reported from a Cloudflare-fronted install (#1616), where the visible symptom was Uppy's "Could not read the ETag header" — which names CORS, and sends you chasing a preflight that same-origin requests never make. Naming the content type accurately keeps the response out of every HTML-rewriting path there is, rather than asking each CDN-fronted install to discover this one for itself. The rationale sits inside the header array rather than above the return: Scramble reads a comment attached to a return statement as that response's description in the published OpenAPI document, and this controller is mounted on the API routes too. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>