Serving static files fail when If-Modified-Since header is set to a date later than the file creation time

[kaptajnen]

I recently tested upgrading an application from flask 1.1.4 to flask 2.1.1. After the upgrade I found this weird behavior where requests to static files fail if they have the If-Modified-Since header set to a date later than the creation time of the requested file.

This is causing issues in Chrome where the requested resources will not load. I found a few recent posts on stackoverflow that presents the same issue:
https://stackoverflow.com/questions/71886534/chrome-fails-to-load-some-scripts-stylesheets-with-err-invalid-http-response
https://stackoverflow.com/questions/71890593/python-flask-304-response-on-reload

Here is the output of curl showing a working and non-working request demonstrating this behavior:

$ curl http://127.0.0.1:5000/static/test.txt -H 'If-Modified-Since: Tue, 19 Apr 2022 20:15:45 GMT' -v
*   Trying 127.0.0.1:5000...
* Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0)
> GET /static/test.txt HTTP/1.1
> Host: 127.0.0.1:5000
> User-Agent: curl/7.79.1
> Accept: */*
> If-Modified-Since: Tue, 19 Apr 2022 20:15:45 GMT
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: Werkzeug/2.1.1 Python/3.8.9
< Date: Tue, 19 Apr 2022 20:41:07 GMT
< Content-Disposition: inline; filename=test.txt
< Content-Type: text/plain; charset=utf-8
< Content-Length: 4
< Last-Modified: Tue, 19 Apr 2022 20:15:46 GMT
< Cache-Control: no-cache
< Date: Tue, 19 Apr 2022 20:41:07 GMT
<
* Connection #0 to host 127.0.0.1 left intact
test

$ curl http://127.0.0.1:5000/static/test.txt -H 'If-Modified-Since: Tue, 19 Apr 2022 20:15:46 GMT' -v
*   Trying 127.0.0.1:5000...
* Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0)
> GET /static/test.txt HTTP/1.1
> Host: 127.0.0.1:5000
> User-Agent: curl/7.79.1
> Accept: */*
> If-Modified-Since: Tue, 19 Apr 2022 20:15:46 GMT
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 304 NOT MODIFIED
< Server: Werkzeug/2.1.1 Python/3.8.9
< Date: Tue, 19 Apr 2022 20:41:09 GMT
< Content-Disposition: inline; filename=test.txt
< Cache-Control: no-cache
< Date: Tue, 19 Apr 2022 20:41:09 GMT
< Transfer-Encoding: chunked
<
* Excess found: excess = 5 url = /static/test.txt (zero-length body)
* Connection #0 to host 127.0.0.1 left intact

To reproduce, simply create a minimal flask application (as below), create a test file in static/ and request the file with If-Modified-Since set to a date in the future.

I'm not sure if it is a flask or a werkzeug issue, so I apologize if this is reported in the incorrect place.

from flask import Flask

app = Flask(__name__)

Environment:

• Python version: 3.8.9
• Flask version: 2.1.1

[kaptajnen]

One thing I noticed is that the Content-Disposition header was not previously present in the 304 responses. I don't know if this is related.

[davidism]

Can you test this with the latest 2.1.x branch? I just fixed sending Content-Disposition for 304 and removed buggy keep-alive connections. I can't reproduce this issue now, have a feeling they were all related. I'll release 2.1.2 soon.