Skip to content
cccskills
FreePublished on GitHub

curl-head-vs-get-header-debugging

Fix misleading HTTP response header values when debugging with curl -I or curl -sI. Use when: (1) Response headers differ between curl testing and actual browser/client behavior, (2) Cache-Control or other headers show unexpected values despite correct middleware code, (3) Server-side middleware that only applies to GET requests appears to not work when testing with curl -I. The -I flag sends HEAD requests, and middleware that checks for GET method will skip processing, returning handler-level headers instead of middleware-overridden ones.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile
See how to install

Files included (1)

  • SKILL.md3.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

curl -I Sends HEAD, Not GET — Header Debugging Trap

Problem

When debugging HTTP response headers with curl -I or curl -sI, the response may show different header values than what actual GET requests receive. This is because -I sends a HEAD request, and server middleware that only processes GET requests will be skipped.

Context / Trigger Conditions

  • Testing cache headers with curl -sI and seeing unexpected values
  • Middleware that checks method == GET before setting headers (common in cache middleware)
  • Headers appear correct in automated tests but wrong in manual curl testing
  • Cache-Control, Surrogate-Control, or Surrogate-Key values don't match expectations
  • Axum/Express/any framework middleware with method guards

Solution

Use curl -s -D - -o /dev/null instead of curl -I to get response headers from a GET request:

# WRONG — sends HEAD request, middleware may skip processing
curl -sI https://example.com/api/endpoint

# CORRECT — sends GET request, dumps headers, discards body
curl -s -D - -o /dev/null https://example.com/api/endpoint

If you need just specific headers:

curl -s -D - -o /dev/null https://example.com/api/endpoint | grep -iE 'cache-control|surrogate'

Verification

Compare output from both methods:

echo "=== HEAD (curl -I) ===" 
curl -sI https://example.com/api/endpoint | grep cache-control

echo "=== GET (curl -D) ==="
curl -s -D - -o /dev/null https://example.com/api/endpoint | grep cache-control

If the values differ, your middleware has a GET-only guard (which is correct behavior).

Example

Axum middleware that only sets cache headers for GET requests:

async fn cache_middleware(request: Request, next: Next) -> Response {
    let method = request.method().clone();
    let mut response = next.run(request).await;
    
    // HEAD requests skip this — curl -I won't see these headers!
    if method != Method::GET {
        return response;
    }
    
    response.headers_mut().insert("cache-control", ...);
    response.headers_mut().insert("surrogate-control", ...);
    response
}

Notes

  • This is NOT a bug — it's correct behavior. Cache headers should only apply to cacheable GET responses.
  • HTTP spec says HEAD responses SHOULD include the same headers as GET, but middleware implementations often don't replicate this because HEAD is rarely used by CDNs or browsers for caching decisions.
  • Fastly, Cloudflare, and other CDNs send GET requests to origins, so the cache behavior is correct even if curl -I shows different headers.
  • This trap is especially insidious because curl -I is the most common way to check headers.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

argocd-externalsecret-namespace-permission

Free

Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y". Use when: (1) ExternalSecret shows OutOfSync in ArgoCD but won't sync, (2) ArgoCD application status shows "namespace X is not permitted in project 'infrastructure'", (3) ExternalSecret targets a namespace managed by a different ArgoCD project, (4) Using apps-of-apps pattern with separate infrastructure and application projects.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

art-direct

Free

Art direction for any content — reads text, PDF, Word, HTML, PPT, then proposes 2-3 creative directions with photography style, mood, and visual language. After selection, generates AI image prompts and visual briefs section-by-section. Use when the user shares content and needs visual direction, image sourcing, or creative direction for any material.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

async-await-null-race-condition

Free

Fix "Null check operator used on a null value" errors when an object is set to null during an async await. Use when: (1) Object reference is nullified while awaiting, (2) Code accesses object with ! after await returns, (3) Cancel/dispose operations run concurrently with async operations on same object. Solution: capture local reference before await.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

aws-v4-signing-custom-headers-gcs

Free

Add custom metadata headers (x-amz-meta-*) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta-* headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

bash-herestring-newline-secrets

Free

Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication failed" or "invalid token" despite correct value. Bash here-strings (`<<<`) add a trailing newline that corrupts secrets.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

blossom-content-addressed-url-filtering

Free

Fix silent video/media processing failures caused by URL extraction code that filters on file extensions (.mp4, .webm, .webp). Use when: (1) Media moderation, transcoding, or analysis silently skips files from Blossom or content-addressed storage servers, (2) URL extraction from Nostr event tags (imeta, r tags) drops URLs without recognized extensions, (3) CDN fallback URLs append .mp4 but the actual server uses extensionless content-addressed paths like /{sha256}. Common in Nostr video events (kind 34236) where different clients use different URL formats.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

See all skills by divinevideo

Report a problem with this skill