cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/hubApi/apiUtils.c src/hg/hubApi/apiUtils.c
index e1f8c244c4f..cc0fa14c4e3 100644
--- src/hg/hubApi/apiUtils.c
+++ src/hg/hubApi/apiUtils.c
@@ -9,47 +9,46 @@
 static long processingStart = 0;
 
 void startProcessTiming()
 /* for measureTiming, beginning processing */
 {
 processingStart = clock1000();
 }
 
 void apiFinishOutput(int errorCode, char *errorString, struct jsonWrite *jw)
 /* finish json output, potential output an error code other than 200 */
 {
 /* this is the first time any output to stdout has taken place for
  * json output, therefore, start with the appropriate header.
  */
 puts("X-Content-Type-Options: nosniff");
-puts("Content-Type:application/json");
 /* potentially with an error code return in the header */
 if (errorCode)
     {
     char errString[2048];
     safef(errString, sizeof(errString), "Status: %d %s",errorCode,errorString);
     puts(errString);
     if (err429 == errorCode)
 	puts("Retry-After: 30");
     }
 else if (reachedMaxItems)
     {
     char errString[2048];
     safef(errString, sizeof(errString), "Status: %d %s",err206,err206Msg);
     puts(errString);
     }
-puts("\n");
+cgiPrintContentType("application/json");
 
 if (measureTiming)
     {
     long nowTime = clock1000();
     long long et = nowTime - processingStart;
     jsonWriteNumber(jw, "totalTimeMs", et);
     }
 
 if (itemsReturned)
     jsonWriteNumber(jw, "itemsReturned", itemsReturned);
 if (reachedMaxItems)
     {
     jsonWriteBoolean(jw, "maxItemsLimit", TRUE);
     if (downloadUrl && downloadUrl->string)
 	jsonWriteString(jw, "dataDownloadUrl", downloadUrl->string);
@@ -823,31 +822,31 @@
              tm.tm_sec);
         dyStringPrintf(textOutput, "%s\n", outString);
         safef(outString, sizeof(outString), "# downloadTimeStamp: %lld",
             (long long) timeNow);
         dyStringPrintf(textOutput, "%s\n", outString);
         }
     }
 
 dyStringPrintf(textOutput, "%s\n", lineOut);
 }
 
 void textFinishOutput()
 /* all done with text output, print it all out */
 {
 puts("X-Content-Type-Options: nosniff");
-puts("Content-Type:text/plain\n");
+cgiPrintContentType("text/plain");
 printf("%s", dyStringCannibalize(&textOutput));
 }
 
 static char *thisHostName()
 /* Return this machine's own hostname via gethostname().  Unlike hHttpHost(),
  * which reflects the client-supplied HTTP_HOST/Host: header, this can't be
  * spoofed by the request and doesn't change depending on which round-robin
  * name (e.g. genome.ucsc.edu) the client used to reach this box -- using
  * hHttpHost() here made onGenomeRRMachine() misclassify RR machines reached
  * via the genome.ucsc.edu name, sending them into an infinite self-relay
  * loop. */
 {
 static char host[256];
 static boolean init = FALSE;
 if (!init)