Fail to download a remote https svg file but embed inside <img> is good

Question

I have a https link, embedded into <img>, everything is good. Such as https://jsfiddle.net/Lbhhtt6n/. However, if you try to download link directly such as directly open it with browser with link https://version.gitlab.com/check.svg?gitlab_info=eyJ2ZXJzaW9uIjoiOC4xNi4wLXByZSJ9 , then 404 error returned.

Due to this issue, I cannot check head by httparty

response = HTTParty.head('https://version.gitlab.com/check.svg?gitlab_info=eyJ2ZXJzaW9uIjoiOC4xNi4wLXByZSJ9')
puts response.success? # always return false

What's the magic behind it? Anyone could enlighten me? Thanks.

Answer 1

Gitlab only gives you the image if you inform HTTP Refer header. Otherwise it responds with 404. See details at https://about.gitlab.com/handbook/sales-process/version_check.

When you try to obtain resource by your browser address bar or by any other tool without explicitly setting that header, you will get 404.

It works when loading as page resource (img tag for example) because browse will send that header for you.

Give a try yourself to see it in action:

$ curl -v https://version.gitlab.com/check.svg?gitlab_info=eyJ2ZXJzaW9uIjoiOC4xNi4wLXByZSJ9

$ curl -v https://version.gitlab.com/check.svg?gitlab_info=eyJ2ZXJzaW9uIjoiOC4xNi4wLXByZSJ9 -e stackoverflow.com

---

See the difference shown by Chrome Developer Tool:

As page resource:

From address bar: