cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/lib/verbose.c src/lib/verbose.c
index 9d55d1832b8..66067e25da1 100644
--- src/lib/verbose.c
+++ src/lib/verbose.c
@@ -1,25 +1,26 @@
 /* verbose.c - write out status messages according to the
  * current verbosity level.  These messages go to stderr. */
 
 /* Copyright (C) 2011 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
 #include "portable.h"
 #include "verbose.h"
 #include "obscure.h"
+#include "cheapcgi.h"
 
 
 static int logVerbosity = 1;	/* The level of log verbosity.  0 is silent. */
 static FILE *logFile;	/* File to log to. */
 
 static boolean checkedDotsEnabled = FALSE;  /* have we check for dot output
                                              * being enabled? */
 static boolean dotsEnabled = FALSE;         /* is dot output enabled? */
 
 static boolean doHtml = FALSE;
 
 void verboseVa(int verbosity, char *format, va_list args)
 /* Log with at given verbosity vprintf formatted args. */
 {
 if (verbosity <= logVerbosity)
@@ -139,19 +140,19 @@
 if (logFile == NULL)
     logFile = stderr;
 return logFile;
 }
 
 void verboseCgi(char *level) 
 /* Set verbosity level for a CGI: if level is not NULL, set output file to stdout, set verbosity and print a content-type header */
 {
     if (level==NULL)
         return;
     int levelNum = atoi(level);
     if (levelNum==0)
         return;
     verboseSetLevel(levelNum);
     verboseSetLogFile("stdout");
-    puts("Content-type: text/html\n");
+    cgiPrintContentType("text/html");
     doHtml = TRUE;
     verbose(0, "Debugging output activated, level %d", levelNum);
 }