Cross origin Server Push extra request issue on Safari v12+ (both MacOS and iOS)

Question

Problem: Safari is doing a request with the pushed path but to the site host, resulting in 404s.

Scenario: Cross origin asset that is server pushed. Asset's host and site's host are different domains.

Browser: Safari v12+ (also v13) in both MacOS and iOS.

It is worth noting that the server push feature it self works, but Safari makes this extra request to the host. Also this doesn't happen on Safary v10 or v11.

Answer 1

I ran into this too, and confirmed (by re-writing with Charles Proxy) that Safari does load resources in a link header from the cross-origin domain if the link header uses an absolute path that includes a domain.

This type of HTTP response will not work in Safari:

HTTP/2 200
content-type: application/javascript; charset=utf-8
... other headers
link: </script.js>; rel=preload; as=script; crossorigin

Instead, you need to include the full domain and protocol, like so:

HTTP/2 200
content-type: application/javascript; charset=utf-8
... other headers
link: <https://www.example.com/script.js>; rel=preload; as=script; crossorigin

This is different from most server push tutorials which have a path that's absolute from the root of the domain (e.g. /script.js), but I've confirmed that it works correctly in Safari even when the server-push response is for a JavaScript resource on a different domain than the one that the HTML page lives on.

Answer 2

Scenario: Cross origin asset that is server pushed. Asset's host and site's host are different domains.

You cannot push a resource for another domain except in for very limited circumstances. The server has to be authorative for this server. Basically that means it goes to same IP address and is covered by same certificate. So if you are on www.example.com and have a separate sharded domain on static.example.com on the same server you can in theory push from that. However browser support is really poor for this and I really wouldn't recommend it. You can use the preload resource hint for that instead which is much better understood and supported.

Problem: Safari is doing a request with the pushed path but to the site host

As per above link, Safari does not support cross domain pushing. And neither do lots of other browsers.

resulting in 404s.

That would make sense since the resource you are requesting to push does not exist on that domain

It is worth noting that the server push feature it self works, but Safari makes this extra request to the host.

Then why do you think it is working?

Also this doesn't happen on Safary v10 or v11.

What doesn’t happen? The push? The double download? Both?