Repository navigation
query.live fetch headers must contain "accept: text/event-stream" so bypass MITM anti-viruses and proxies #16606
Description
Describe the bug
This issue continues old chain of proxy-related SSE problems: #15921
So I won't describe all this in here, it is a bit redundant.
I finally managed to reproduce those users problems: Some antiviruses and/or MITM proxies breaks query.live and make the requests hung forever.
The solution is quite simple: SSE requests must contain accept: text/event-stream header. That's all.
I have tested it on the real Kaspersky MITM traffic analyzer - it works.
The point is sveltekit is using fetch instead of EventSource to simplify some thing (personally I did the PR), but we do not imitate it's behavior. I compared the headers and the only difference was that EventSource adds accept: text/event-stream header while fetch keeps accept: *.
The change is in this small file
But there I see
which is, in fact, will never be reached if we addaccept.I'm not sure if SSE response could ever make a redirect with a different content-type. Originally EventSource would not accept this behavior.
So, what do you think? Can we add the header and what to do with the redirect?
Reproduction
As as temporary solution I'm using this snippet in hooks.client:
(() => {
const _fetch = window.fetch.bind(window);
window.fetch = (input, init = {}) => {
const url = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);
if (url.includes('/remote/')) {
const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
headers.set('Accept', 'text/event-stream');
init = {...init, headers};
console.log('[fetch patch] Accept: text/event-stream', url);
}
return _fetch(input, init);
};
console.log('[fetch patch] enabled');
})();Logs
System Info
---Severity
serious, but I can work around it
Additional Information
No response
Activity
IAkumaI commentedon Aug 1, 2026
Some clarification:
Kaspersky antivirus (a one of the problemmatics) is quite popular, at least around non-english speaking users for sure. And there are a lot of users who struggle on any SK website with query.live randomly.
In fact, it's behavior is totally unclear and it is not documented, I found only two mentions on the internet. I tried different requests without
accept: text/event-streamand it seems random:I could not understand why and how it reacts to the requests, but adding the right headers just heals it.
IAkumaI commentedon Aug 21, 2026
akasakariko commentedon Sep 13, 2026
Opened #17104. Live-query fetches now send
Accept: text/event-stream, while JSON responses from hooks remain supported. Added an SSE content-negotiation regression and a JSON-response regression; the full Kit unit suite, lint, type checks, and async app production build pass locally. The tests use an in-memory transport, so the original Kaspersky setup has not been rerun locally.