cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/visiGene/hgVisiGene/hgVisiGene.c src/hg/visiGene/hgVisiGene/hgVisiGene.c
index af1b6615a53..cf495b2b04f 100644
--- src/hg/visiGene/hgVisiGene/hgVisiGene.c
+++ src/hg/visiGene/hgVisiGene/hgVisiGene.c
@@ -761,32 +761,31 @@
     cartRemove(cart, hgpId);
     }
 else
     {
     cartSetInt(cart, hgpId, id);
     cartSetString(cart, hgpListSpec, genes->name);
     }
 slFreeList(&genes);
 doDefault(conn, FALSE);
 }
 
 
 static void problemPage(char *msg, char *url)
 /* send back a page describing problem */
 {
-printf("Content-Type: text/html\n");
-printf("\n");
+cgiPrintContentType("text/html");
 htmStart(stdout, "do download");
 printf("%s %s",msg,url);
 htmlEnd();
 }
 
 static void doDownload(struct sqlConnection *conn)
 /* Try to force user's browser to download by giving special response headers */
 {
 int imageId = cartUsualInt(cart, hgpId, 0);
 char url[1024];
 char *p = NULL;
 char dir[PATH_LEN];
 char name[FILENAME_LEN];
 char extension[FILEEXT_LEN];
 int w = 0, h = 0;
@@ -811,33 +810,32 @@
 	}
     else
 	{
 	char *newUrl = NULL;
 	int newSd = 0;
 	/* url needed for err msgs and redirect url*/
 	if (netSkipHttpHeaderLinesHandlingRedirect(sd, url, &newSd, &newUrl))
 	    {
 	    char buf[32*1024];
 	    int readSize;
 	    if (newUrl)
 		{
 		freeMem(newUrl);
 		sd = newSd;
 		}
-	    printf("Content-Type: application/octet-stream\n");
 	    printf("Content-Disposition: attachment; filename=%s%s\n", name, extension);
-	    printf("\n");
+	    cgiPrintContentType("application/octet-stream");
 	    while ((readSize = read(sd, buf, sizeof(buf))) > 0)
 	        fwrite(buf, 1,  readSize, stdout);
 	    close(sd);
 	    sd = -1;
 	    fflush(stdout);
 	    fclose(stdout);
 	    }
 	else
 	    {
 	    problemPage("Skip http header problem", url);
     	    }
 	}
     }
 }