cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/hgSearch/hgSearch.c src/hg/hgSearch/hgSearch.c
index d781270cd66..93b55ae37da 100644
--- src/hg/hgSearch/hgSearch.c
+++ src/hg/hgSearch/hgSearch.c
@@ -594,31 +594,31 @@
     struct trackDb *track = NULL;
     if (!sameString(trackName, "chromInfo"))
         {
         track = tdbForTrack(db, trackName, &hgFindTdbList);
         if (!track && startsWith("all_", trackName))
             track = tdbForTrack(db, trackName+strlen("all_"), &hgFindTdbList);
         if (!track)
             errAbort("no track for table \"%s\" found via a findSpec", trackName);
         }
     if (track)
         {
         trackName = cloneString(track->track);
         }
     trackHubFixName(trackName);
     cspWriteResponseHeader();
-    puts("Content-type:text/html\n");
+    cgiPrintContentType("text/html");
     puts("<HTML>\n<HEAD>\n");
     printf("<script type='text/javascript' src='../js/utils.js'></script>\n");
     printf("<script nonce='%s'>\n", getNonce());
     // we are about to redirect back to hgTracks, save the search term onto the
     // history stack so it will appear in the dropdown of auto-suggestions before
     // redirecting.  db and userSearch are user-supplied and go into a JS string literal
     // inside this inline <script>; jsonStringEscape escapes quotes and '/' so neither the
     // string literal nor a literal </script> can break out (XSS).
     char *jsDb = jsonStringEscape(db);
     char *jsSearch = jsonStringEscape(userSearch);
     printf("addRecentSearch(\"%s\", \"%s\", {\"label\": \"%s\", \"value\": \"%s\", \"id\": \"%s\"});\n",
             jsDb, jsSearch, jsSearch, jsSearch, newPosBuf);
     printf("window.location.href=\"../cgi-bin/hgTracks?");
     // db here is a URL query parameter, so cgi-encode it rather than reuse the JS-escaped jsDb
     char *urlDb = cgiEncode(db);