HTTP Headers

Cache directives, conditional validators, content negotiation, compression and transfer encodings, security headers, and response-timing fixtures that exercise how a crawler reads the wire.

Fixtures whose interesting behaviour lives in the response headers and response timing rather than the HTML body.

Families:

• Cache headers: explicit no-cache, no-store, max-age=0, one-year max-age, private, a far-future Expires, a deliberately self-contradictory combination, plus full ETag and Last-Modified conditional-revalidation flows. Every route in this family sets its own Cache-Control value — the site-wide default no-store middleware only applies when a response carries no Cache-Control of its own.
• Negotiation and Content-Type: a Vary: User-Agent response whose body never actually varies, a response with no Content-Type at all, a malformed media type with no type/subtype slash, and a complete HTML document served as text/plain.
• Compression and transfer: gzip, Brotli, and zstd encoded responses, plus a chunked response with no Content-Length. Negotiated encodings and chunking cannot be controlled from the Astro app, so these are owned by the protocol-edge and streaming supporting profiles.
• Security headers: Content-Security-Policy pages whose inline and external probe scripts must never execute, an X-Content-Type-Options: nosniff response, and short and preload Strict-Transport-Security policies served from a supporting HTTPS origin because HSTS applies origin-wide.
• Timing: bounded 5-second and 30-second whole-response delays, and a fast-headers/slow-body stream whose marker arrives as the final chunk.

The delay and stream routes are deliberately hostile to crawler timeouts; they stay out of every sitemap, and the 30-second and slow-body variants are direct-entry only in the risky manifest.

Fixtures in this category

• Cache-Control no-cache — headers-cache-no-cache (safe)
• Cache-Control no-store — headers-cache-no-store (safe)
• Cache-Control max-age=0 — headers-cache-max-age-zero (safe)
• Cache-Control one-year max-age — headers-cache-long (safe)
• Cache-Control private — headers-cache-private (safe)
• Expires header — headers-expires (safe)
• Conflicting cache headers — headers-cache-conflict (safe)
• ETag conditional flow — headers-etag (safe)
• Last-Modified conditional flow — headers-last-modified (safe)
• Vary on User-Agent with identical content — headers-vary-user-agent (safe)
• Content-Type malformed — headers-content-type-malformed (safe)
• HTML body served as text/plain — headers-text-plain-html (safe)
• Compression — gzip encoded response — headers-gzip (safe)
• Compression — brotli encoded response — headers-brotli (safe)
• Delayed response — 5 seconds — headers-delay-5s (moderate)
• CSP blocks inline scripts — headers-csp-inline-block (safe)
• CSP blocks an external script — headers-csp-external-block (safe)
• X-Content-Type-Options nosniff — headers-nosniff (safe)
• HSTS — short max-age — headers-hsts-short (moderate)
• HSTS — long max-age with preload — headers-hsts-long-preload (moderate)

Back to the fixture index