When it does not work
Why a site refuses to open a file
Sometimes a file will not open, and the useful question is not "how do I force it" but "which of these two things happened". A site refusing a request and a request failing look identical from a distance and want opposite responses. Foretaste tells them apart and says which one you have.
01
A refusal is not a fault
A refusal means the site was reached, it understood exactly what was being asked, and it decided no. Sign-in, a bot check, a paywall, a 403. Nothing is broken. The site is asking the person for something, and a browser tab is the only thing that can answer.
A fault means something did not work: the file is not there, the server is having a bad minute, the network is not reachable, or the bytes arrived and were not readable. Here retrying, waiting or going back for a fresh link are all sensible, and none of them are sensible for a refusal.
This is why "just try again" is bad advice for half of these. Retrying a 403 gets you the same 403 with more of somebody else's bandwidth spent on it.
02
The four refusals
In all four of these the site has made a decision about you rather than about the file. Foretaste offers exactly one thing: open the page, in an ordinary visible tab, at the address you chose.
| What you see | Answer | What it means | What actually helps |
|---|---|---|---|
| Sign-in needed | 401 | The file is there and it is not public. A sign-in page arriving where a file was expected counts as this too. | Sign in at that site in an ordinary tab, then open the file again. |
| Bot check | Cloudflare and friends | The site is asking whoever is asking to prove they are a person. It is aimed at you, not at the file. | Open the site once in a tab and let your browser pass the check. The clearance is a cookie your browser then carries. |
| Paywall | 402 | The file is behind a payment or a subscription. | Sort it out with the site in a tab. Foretaste will not try to open a paywalled file. |
| Refused | 403 | The site was reached, it understood exactly what was being asked, and it said no. Hotlink protection, a region rule, an expired token, or a rule about extensions. | Open it in a tab, or save it to disk. Both of those go through your browser rather than through Foretaste. |
03
The six faults
These are things going wrong rather than a site declining. Some of them are worth retrying and the table says which.
| What you see | Answer | What it means | What actually helps |
|---|---|---|---|
| Nothing there | 404 or 410 | The file moved or was deleted, or the link was a signed one and its time is up. An expired signed link looks exactly like a missing file from the outside. | Go back to the page that offered the link and get a fresh one. |
| Too many requests | 429 | The site is asking everybody to slow down. It is usually brief. | Wait. Nothing about the file has changed and waiting is the whole of the fix. |
| Their end | 5xx | Something broke on the site itself. The file is probably fine. | Try again in a minute. |
| Nothing answered | no response | One of three things: no network, an insecure http address a secure page may not request, or a site that does not allow its files to be fetched from anywhere but its own pages. The browser will not say which. | Open the link in a tab. If it works there, it was the third one. |
| Not an address it can open | not http | Only http and https are fetched. Anything else is either something the browser opens itself or something no page is allowed to read. | Click it and let the browser handle it. |
| Unreadable | arrived, but | The bytes came through and are not something Foretaste can draw: a format it does not support, or a damaged file. | Save it and open it in something else. Saving always works. |
04
The silent one, which is usually CORS
The confusing failure is the one where nothing comes back at all and there is no status to read. It is one of three things and the browser will not tell you which, on purpose: explaining to a page why a cross-origin request failed would itself give something away.
- No network. The dull one, and worth ruling out first.
- An
http://address requested from anhttps://page. The browser blocks it before it leaves. There is nothing to do except find a secure address for the same file. - The site does not allow its files to be fetched from other pages. This is the common one. A server that sends no cross-origin headers is telling every browser on earth that its files are for its own pages and nowhere else, and that is an entirely reasonable thing for a server to say.
The tell is simple: if the link opens fine when you click it normally but not through a preview, it was the third one.
A related case is the reason the permission is shaped the way it is. Some sites hand a
download off to whichever storage machine is nearest, so a link on archive.org
lands on a host like dn721809.ca.archive.org — a name you have never seen
and could not have allowed in advance. That is why website access is one permission granted
at install rather than a list you build up per site, and why
the privacy page argues it at length.
05
What Foretaste will not do about any of this
None of the following is in the extension, and none of it is an oversight or a thing on a list to build later:
- Reading your cookies
- Carrying a clearance or challenge token
- Solving a CAPTCHA
- Pretending to be a different browser
- Opening a hidden tab you cannot see
- Retrying the same request with different headers until the answer changes
A Referer retry for 403s was built once and then removed, which is the honest
version of this paragraph. It worked. It was also asking the same question a second time in
a different voice, hoping for a different answer, which is what working around an access
control is however good the intention was. The permission it needed went with it, and the
build now refuses that permission by name.
There is a practical reason as well as a principled one. A preview tool that routes around access controls is a preview tool that gets extensions blocked, and then it works nowhere for anybody.
06
Saving still works, in every one of these cases
Save to disk needs no website access at all. It hands the address to the browser's own download machinery, which is the same thing that happens when you click a link normally, so it works on a site you declined, on a site you were never asked about, and behind a refusal Foretaste cannot pass. That is what keeps the save button genuinely never gated.
So the fallback is always the same shape: if the preview will not open, save it, or open the page in a tab and deal with whatever the site is asking for. Both routes go through your browser rather than through Foretaste.
Questions this raises
Why does a preview fail on a site where the download works?
Almost always the third case above: the server does not allow its files to be fetched from other pages. Clicking a link is not a cross-origin fetch and is not subject to that rule. Save to disk takes the clicking route, so it keeps working.
Foretaste says a bot check, but I have never seen one on that site.
Somebody who was handed the address has not been through the front door. Open the site once in a tab, let your browser pass the check, and try again. The clearance is a cookie your browser holds and carries on the next request.
The link worked yesterday and gives "nothing there" today.
A signed link with a time limit looks exactly like a deleted file once it expires. Go back to the page that gave you the link and take a fresh one.
Can I stop Foretaste trying on a particular site?
Yes, per site, in Settings, and the popup switch means "buttons here" whichever way the list is being read. Turning Foretaste off altogether unregisters the part that runs on pages, so "off" means the code is not running rather than running and declining. What Foretaste can and cannot see has the whole of it.
The questions people ask
Why does a file preview fail with 403 Forbidden?
A 403 is a decision rather than a fault: the site was reached, it understood the request, and it refused it. Common reasons are hotlink protection, a region rule, an expired signed link, or a rule about automated requests. Foretaste reports it and stops. Opening the link in an ordinary tab, or saving the file to disk, both go through your browser instead and usually work.
Why can a browser extension not get past a Cloudflare bot check?
A bot check is a question aimed at a person, and only that person can answer it. Foretaste does not read your cookies, carry a clearance token or solve a challenge. Opening the site once in an ordinary tab lets your browser pass the check, and the clearance cookie your browser then holds is carried on the next attempt.
What does it mean when nothing answers at all?
No response is one of three things: no network, an insecure http address that a secure page is not allowed to request, or a site that does not permit its files to be fetched from anywhere but its own pages. The browser deliberately does not say which of the three it was, because telling a page why a cross-origin request failed would itself reveal something.
Can I still save a file when the preview will not open?
Yes. Save to disk needs no website access and goes through the browser download machinery rather than through Foretaste, so it works even when a preview does not and even on sites you have never granted access to.