diff --git a/http/HttpMessage.h b/http/HttpMessage.h
index 55e5c62be..5be241957 100644
--- a/http/HttpMessage.h
+++ b/http/HttpMessage.h
@@ -219,7 +219,9 @@ class HV_EXPORT HttpMessage {
         if (file.open(filepath.c_str(), "wb") != 0) {
             return HTTP_STATUS_INTERNAL_SERVER_ERROR;
         }
-        file.write(formdata.content.data(), formdata.content.size());
+        if (file.write(formdata.content.data(), formdata.content.size()) != formdata.content.size()) {
+            return HTTP_STATUS_INTERNAL_SERVER_ERROR;
+        }
         return 200;
     }
 
diff --git a/http/server/HttpHandler.cpp b/http/server/HttpHandler.cpp
index 7cc21a99d..477a8469c 100644
--- a/http/server/HttpHandler.cpp
+++ b/http/server/HttpHandler.cpp
@@ -586,6 +586,11 @@ int HttpHandler::defaultStaticHandler() {
         }
         long total = file->size();
         if (to == 0 || to >= total) to = total - 1;
+        if (from < 0 || from >= total || to < from) {
+            closeFile();
+            resp->SetHeader("Content-Range", hv::asprintf("bytes */%ld", total));
+            return HTTP_STATUS_RANGE_NOT_SATISFIABLE;
+        }
         file->seek(from);
         status_code = HTTP_STATUS_PARTIAL_CONTENT;
         resp->status_code = HTTP_STATUS_PARTIAL_CONTENT;
@@ -1046,9 +1051,8 @@ int HttpHandler::handleForwardProxy() {
         return connectProxy(req->url);
     } else {
         hlogw("[%s:%d] Forbidden to forward proxy %s", ip, port, req->url.c_str());
-        SetError(HTTP_STATUS_FORBIDDEN, HTTP_STATUS_FORBIDDEN);
+        return SendHttpStatusResponse(HTTP_STATUS_FORBIDDEN);
     }
-    return 0;
 }
 
 int HttpHandler::handleReverseProxy() {
@@ -1079,8 +1083,7 @@ int HttpHandler::connectProxy(const std::string& strUrl) {
 
     if (forward_proxy && !service->IsTrustProxy(url.host.c_str())) {
         hlogw("[%s:%d] Forbidden to proxy %s", ip, port, url.host.c_str());
-        SetError(HTTP_STATUS_FORBIDDEN, HTTP_STATUS_FORBIDDEN);
-        return 0;
+        return SendHttpStatusResponse(HTTP_STATUS_FORBIDDEN);
     }
 
     hloop_t* loop = hevent_loop(io);
@@ -1102,10 +1105,10 @@ int HttpHandler::connectProxy(const std::string& strUrl) {
         hio_set_connect_timeout(upstream_io, service->proxy_connect_timeout);
     }
     if (service->proxy_read_timeout > 0) {
-        hio_set_read_timeout(io, service->proxy_read_timeout);
+        hio_set_read_timeout(upstream_io, service->proxy_read_timeout);
     }
     if (service->proxy_write_timeout > 0) {
-        hio_set_write_timeout(io, service->proxy_write_timeout);
+        hio_set_write_timeout(upstream_io, service->proxy_write_timeout);
     }
     hio_connect(upstream_io);
     // NOTE: wait upstream_io connected then start read
diff --git a/http/server/HttpMiddleware.cpp b/http/server/HttpMiddleware.cpp
index 45607908c..c2a4f7bdd 100644
--- a/http/server/HttpMiddleware.cpp
+++ b/http/server/HttpMiddleware.cpp
@@ -4,7 +4,11 @@
 BEGIN_NAMESPACE_HV
 
 int HttpMiddleware::CORS(HttpRequest* req, HttpResponse* resp) {
-    resp->headers["Access-Control-Allow-Origin"] = req->GetHeader("Origin", "*");
+    std::string origin = req->GetHeader("Origin", "*");
+    resp->headers["Access-Control-Allow-Origin"] = origin;
+    if (origin != "*") {
+        resp->headers["Vary"] = "Origin";
+    }
     if (req->method == HTTP_OPTIONS) {
         resp->headers["Access-Control-Allow-Methods"] = req->GetHeader("Access-Control-Request-Method", "OPTIONS, HEAD, GET, POST, PUT, DELETE, PATCH");
         resp->headers["Access-Control-Allow-Headers"] = req->GetHeader("Access-Control-Request-Headers", "Content-Type");