206 vs 404 — Range Fulfillment

A GET request with a satisfiable Range header reaches range evaluation for an existing target. The server identifies the selected representation, evaluates the range against it, and returns 206 Partial Content. A nonexistent target terminates at 404 before reaching range fulfillment.

• What leaks: 206 confirms the server successfully fulfilled a range request against the selected representation. Content-Range headers confirm partial-transfer semantics and may disclose representation metadata. This is a SHOULD-level route to 206 — the server MAY ignore the Range header and return a full 200 instead. RFC 9110 defines range handling only for GET.