ВажливоПомилка
Markdown content negotiation
Add content negotiation in the route or middleware: render clean page text for Markdown requests while keeping HTML for browsers.
Деталі аудиту
Markdown content negotiation
Метадані
- Категорія
- Доступність контенту
- Remediation key
- markdown_negotiation_missing
- URL
- https://api.starveri.net/
Очікуваний результат
A request with `Accept: text/markdown` returns a Markdown representation, `Content-Type: text/markdown`, and `Vary: Accept` without breaking HTML.
Як виправити
Add content negotiation in the route or middleware: render clean page text for Markdown requests while keeping HTML for browsers.
Промпт для AI-агента
You are a senior web developer. Improve api.starveri.net for AI agents. Task: add or repair support for Markdown content negotiation (markdown_negotiation). Current check result:
JSON
{"evidence":{"body_size_bytes":20883,"final_url":"https://api.starveri.net/credits","has_markdown_content_type":false,"has_vary_accept":false,"headers":{"content-type":"text/html; charset=utf-8","vary":"Origin"},"markdown":{"has_code_fence":false,"has_heading":false,"has_link":false,"has_list":true,"html_tag_count":61,"looks_like_markdown":false,"non_empty_line_count":449,"signal_count":1},"redirects":[{"location":"/credits","status_code":302,"url":"https://api.starveri.net/"}],"requested_url":"https://api.starveri.net/","snippet":"<!doctype html> <html lang=\"en\"> <head> <meta charset=\"utf-8\"> <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"> <title>Starveri API Credits</title> <style> :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sa","status_code":200},"outputs":{"body_size_bytes":20883,"has_markdown_content_type":false,"has_vary_accept":false,"markdown_signal_count":1},"remediation_key":"markdown_negotiation_missing","scanner_message":"Target page does not expose a Markdown representation.","status":"fail"}Expected result: A request with `Accept: text/markdown` returns a Markdown representation, `Content-Type: text/markdown`, and `Vary: Accept` without breaking HTML.. Fix guidance: Add content negotiation in the route or middleware: render clean page text for Markdown requests while keeping HTML for browsers.. Stack templates: - Generic web server: serve `Accept: text/markdown` negotiation from the public web root or a route, with the correct status, `Content-Type`, and cache policy. - Nginx: add a `location`/`add_header` for `Accept: text/markdown` negotiation; verify `try_files`, redirects, and that private upstreams are not exposed. - Apache: configure `Alias`, `Header set`, or a rewrite rule for `Accept: text/markdown` negotiation; check `.htaccess` and virtual host precedence. - Next.js: use `public/`, route handlers, Metadata API, or middleware for `Accept: text/markdown` negotiation; do not disable SSR/SSG for public content. - Nuxt: use `public/`, server routes, `useHead`/Nitro middleware for `Accept: text/markdown` negotiation; verify prerender/SSR output. - Laravel: add a route/controller, Blade metadata, or middleware headers for `Accept: text/markdown` negotiation; do not bypass auth/authorization for private routes. - Django: add a `urls.py` route/view, template metadata, or middleware headers for `Accept: text/markdown` negotiation; verify `ALLOWED_HOSTS` and cache behavior. - WordPress: implement `Accept: text/markdown` negotiation via theme/plugin hooks, SEO plugin settings, or a static file; do not edit core files. - Bitrix: add `Accept: text/markdown` negotiation via the site template, component, or web server config; verify composite cache and multi-site rules. - Static hosting: add `Accept: text/markdown` negotiation as a static asset or platform headers file (`_headers`, `vercel.json`, `netlify.toml`). - Headless CMS: generate `Accept: text/markdown` negotiation in the delivery layer/edge app from published content; do not expose draft or admin APIs. Constraints: do not break SEO; do not expose private endpoints; preserve SSRF/redirect safety; do not add remote JS execution to the scanner; add tests. Return a patch/diff and a short explanation.
Evidence JSON
{ "headers": { "vary": "Origin", "content-type": "text/html; charset=utf-8" }, "snippet": "<!doctype html> <html lang=\"en\"> <head> <meta charset=\"utf-8\"> <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"> <title>Starveri API Credits</title> <style> :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sa", "markdown": { "has_link": false, "has_list": true, "has_heading": false, "signal_count": 1, "has_code_fence": false, "html_tag_count": 61, "looks_like_markdown": false, "non_empty_line_count": 449 }, "final_url": "https://api.starveri.net/credits", "redirects": [ { "url": "https://api.starveri.net/", "location": "/credits", "status_code": 302 } ], "status_code": 200, "requested_url": "https://api.starveri.net/", "body_size_bytes": 20883, "has_vary_accept": false, "has_markdown_content_type": false }{ "body_size_bytes": 20883, "has_vary_accept": false, "markdown_signal_count": 1, "has_markdown_content_type": false }"markdown_negotiation_missing""Target page does not expose a Markdown representation.""fail"