query.live fetch headers must contain "accept: text/event-stream" so bypass MITM anti-viruses and proxies

[IAkumaI]

Describe the bug

This issue continues old chain of proxy-related SSE problems: #15921
So I won't describe all this in here, it is a bit redundant.

I finally managed to reproduce those users problems: Some antiviruses and/or MITM proxies breaks query.live and make the requests hung forever.

The solution is quite simple: SSE requests must contain accept: text/event-stream header. That's all.
I have tested it on the real Kaspersky MITM traffic analyzer - it works.

The point is sveltekit is using fetch instead of EventSource to simplify some thing (personally I did the PR), but we do not imitate it's behavior. I compared the headers and the only difference was that EventSource adds accept: text/event-stream header while fetch keeps accept: *.

The change is in this small file

kit/packages/kit/src/runtime/client/remote-functions/query-live/iterator.js

Line 28 in e76b3d7

signal: controller.signal

But there I see

kit/packages/kit/src/runtime/client/remote-functions/query-live/iterator.js

Line 45 in e76b3d7

if (response.headers.get('content-type')?.includes('application/json')) {

which is, in fact, will never be reached if we add accept.
I'm not sure if SSE response could ever make a redirect with a different content-type. Originally EventSource would not accept this behavior.

So, what do you think? Can we add the header and what to do with the redirect?

Reproduction

As as temporary solution I'm using this snippet in hooks.client:

(() => {
    const _fetch = window.fetch.bind(window);
    window.fetch = (input, init = {}) => {
        const url = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);
        if (url.includes('/remote/')) {
            const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
            headers.set('Accept', 'text/event-stream');
            init = {...init, headers};
            console.log('[fetch patch] Accept: text/event-stream', url);
        }
        return _fetch(input, init);
    };
    console.log('[fetch patch] enabled');
})();

Logs

System Info

---

Severity

serious, but I can work around it

Additional Information

No response

[IAkumaI]

Some clarification:
Kaspersky antivirus (a one of the problemmatics) is quite popular, at least around non-english speaking users for sure. And there are a lot of users who struggle on any SK website with query.live randomly.

In fact, it's behavior is totally unclear and it is not documented, I found only two mentions on the internet. I tried different requests without accept: text/event-stream and it seems random:

• Might work without issues
• Might hang for 30-60 seconds and than starts working
• Might hang forever
• Sometimes warming up the buffer (i suppose) helps, sometimes does not

I could not understand why and how it reacts to the requests, but adding the right headers just heals it.