cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c
index 26383a10b2b..1e7111cd3f8 100644
--- src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c
+++ src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c
@@ -1055,31 +1055,31 @@
     varName, itemPlural, varName);
 return varVal;
 }
 
 
 void doDownloadUrls()
 /* serve textfile with file URLs and ask user's internet browser to save it to disk */
 {
 struct sqlConnection *conn = sqlConnect(cdwDatabase);
 user = cdwCurrentUser(conn);
 
 // on non-public cirm (and development vhosts) users must be logged in to use download tokens. 
 if (user==NULL && !isPublicSite)
     {
     // this should never happen through normal UI use
-    puts("Content-type: text/html\n\n");
+    cgiPrintContentType("text/html");
     puts("Error: user is not logged in");
     return;
     }
 
 // on public cirm we have users not logged in. user=NULL and download tokens are not required
 char *token = NULL;
 if (!isPublicSite)
     {
     token = createTokenForUser();
     }
 
 // if we recreate the submission dir structure, we need to create a shell script
 boolean createSubdirs = FALSE;
 if (sameOk(cgiOptionalString("cdwDownloadName"), "subAndDir"))
     createSubdirs = TRUE;
@@ -2202,31 +2202,31 @@
 
 void doMiddle()
 /* Menu bar has been drawn.  We are in the middle of first section. */
 {
 struct sqlConnection *conn = sqlConnect(cdwDatabase);
 user = cdwCurrentUser(conn);
 dispatch(conn);
 sqlDisconnect(&conn);
 }
 
 static void doSendMenubar()
 /* print http header and menu bar string */
 {
 oldVars = hashNew(0);
 cart = cartAndCookieWithHtml(hUserCookie(), excludeVars, oldVars, TRUE);
-puts("Content-Type: text/html\n\n");
+cgiPrintContentType("text/html");
 char* mb = cdwLocalMenuBar(cart, TRUE);
 puts(mb);
 }
 
 static void doSendUserName()
 /* send username and authentication method info in a tiny JSON block */
 {
 oldVars = hashNew(0);
 cart = cartAndCookieWithHtml(hUserCookie(), excludeVars, oldVars, TRUE);
 printf("{\n");
 int firstEntry = 1;
 if (loginUseBasicAuth())
     {
     if (!firstEntry)
         printf(",");