998149024f8bde04e8b76638043cfeac3d158731
max
  Tue Sep 15 05:47:27 2026 -0700
Queue the cart cookie and the content policy instead of printing them, refs #38353

cartWriteHeaderAndCont() guards on cgiDidContentType(), which any cgiPrintContentType()
anywhere sets.  An early warn() during cartNew -- "Unable to load session file" reaches the
early warning handler, which calls htmlStart -- prints the header before there is a cart,
and from then on the Set-Cookie and Content-Security-Policy lines were silently skipped.
Nothing changed on the wire, since before the guard they landed in the page body as text
and were equally inert, but skipping them silently is not the behaviour to keep.

cartWriteCookie() and cspWriteResponseHeader() now hand their lines to cgiAddHttpHeader(),
so whichever call prints the content type prints them too and the order of the calls no
longer matters.  cartAndCookieWithHtml() queues the policy before the early handlers are
pushed, so even a page written by that early warn carries one.  The cookie cannot be queued
that early -- there is no cart yet -- and is still lost on that path; the comment says so.

cgiAddHttpHeader() now does what its own comment already promised and ignores a header
added after the block was closed, rather than growing a list nothing will ever print.

getCspPolicyString() is declared in htmshell.h so hCommon.c can queue the value on its own.

diff --git src/hg/lib/hCommon.c src/hg/lib/hCommon.c
index 8768a57f18b..2bd6de4a400 100644
--- src/hg/lib/hCommon.c
+++ src/hg/lib/hCommon.c
@@ -423,31 +423,35 @@
  * from user input. This disables the logging stack dumps. */
 {
 va_list args;
 va_start(args, format);
 hVaUserAbort(format, args);
 va_end(args);
 }
 
 boolean hAllowAllTables(void)
 /* Return TRUE if hg.conf's hgta.disableAllTables doesn't forbid an 'all tables' menu. */
 {
 return !cfgOptionBooleanDefault("hgta.disableAllTables", FALSE);
 }
 
 void cspWriteResponseHeader(void)
-/* Write the Content Security Policy as an http response header, if hg.conf
- * turns it on.  Must be called before the blank line that ends the http header
- * block.  Only the first call in a process writes anything.
+/* Queue the Content Security Policy as an http response header, if hg.conf turns it on.
+ * cgiPrintContentType() writes it, so this only has to run before that does; it does not
+ * have to be the thing that writes the line, and a caller that has already closed the
+ * header block simply loses it rather than printing a header into the page body.
+ * Only the first call in a process queues anything.
  *
  * This exists so that pages which build their own http header block, and so
  * never reach the library code that writes the meta tag, still carry a policy.
  * The gate is off by default so it can be turned on one machine at a time. */
 {
 static boolean written = FALSE;
 if (written)
     return;
 if (!cfgOptionBooleanDefault("cspResponseHeader", FALSE))
     return;
 written = TRUE;
-generateCspResponseHeader(stdout);
+char *policy = getCspPolicyString();
+cgiAddHttpHeader("Content-Security-Policy", policy);
+freeMem(policy);
 }