The toy Accept choice stays narrow.
What this toy model checks
The trust boundary parses one GET request, compares one Accept value with two pinned variants, and validates one response.
recompute Accept choice \text{recompute Accept choice} recompute Accept choice Accept honesty boundary The selected response and body-length check are recomputed from pinned request and response bytes. Accept honesty boundary - GET /item selects application/json, body 14 bytes section name value check request line method GET parsed request line path /item parsed request line version HTTP/1.1 parsed header Host api.example exact header Accept application/json requested type variant 1 type text/html candidate variant 1 body display HTML paragraph cat safe display form variant 1 body hex 3c703e6361743c2f703e pinned bytes variant 1 body bytes 10 counted variant 1 match no Accept compare variant 2 type application/json candidate variant 2 body display JSON name cat safe display form variant 2 body hex 7b226e616d65223a22636174227d pinned bytes variant 2 body bytes 14 counted variant 2 match yes Accept compare status version HTTP/1.1 parsed status status 200 OK ok header Content-Type application/json selected header Content-Length 14 declared bytes body display words JSON name cat safe display form body exact hex 7b226e616d65223a22636174227d pinned bytes check Accept application/json request check selected type application/json response check body bytes 14 sent check match yes same type
Honesty boundary
NOTE: toy HTTP Accept negotiation only; not q-values, wildcards, multiple Accept ranges, language negotiation, compression, caching, Vary behavior, media type parameters, redirects, auth, frameworks, HTTP/2 or HTTP/3, or production server config.
toy Accept only \text{toy Accept only} toy Accept only Accept honesty boundary The selected response and body-length check are recomputed from pinned request and response bytes. Accept honesty boundary - GET /item selects application/json, body 14 bytes section name value check request line method GET parsed request line path /item parsed request line version HTTP/1.1 parsed header Host api.example exact header Accept application/json requested type variant 1 type text/html candidate variant 1 body display HTML paragraph cat safe display form variant 1 body hex 3c703e6361743c2f703e pinned bytes variant 1 body bytes 10 counted variant 1 match no Accept compare variant 2 type application/json candidate variant 2 body display JSON name cat safe display form variant 2 body hex 7b226e616d65223a22636174227d pinned bytes variant 2 body bytes 14 counted variant 2 match yes Accept compare status version HTTP/1.1 parsed status status 200 OK ok header Content-Type application/json selected header Content-Length 14 declared bytes body display words JSON name cat safe display form body exact hex 7b226e616d65223a22636174227d pinned bytes check Accept application/json request check selected type application/json response check body bytes 14 sent check match yes same type
No client compute
The page shows already validated rows. It does not negotiate formats in browser code.
static validated rows \text{static validated rows} static validated rows Accept honesty boundary The selected response and body-length check are recomputed from pinned request and response bytes. Accept honesty boundary - GET /item selects application/json, body 14 bytes section name value check request line method GET parsed request line path /item parsed request line version HTTP/1.1 parsed header Host api.example exact header Accept application/json requested type variant 1 type text/html candidate variant 1 body display HTML paragraph cat safe display form variant 1 body hex 3c703e6361743c2f703e pinned bytes variant 1 body bytes 10 counted variant 1 match no Accept compare variant 2 type application/json candidate variant 2 body display JSON name cat safe display form variant 2 body hex 7b226e616d65223a22636174227d pinned bytes variant 2 body bytes 14 counted variant 2 match yes Accept compare status version HTTP/1.1 parsed status status 200 OK ok header Content-Type application/json selected header Content-Length 14 declared bytes body display words JSON name cat safe display form body exact hex 7b226e616d65223a22636174227d pinned bytes check Accept application/json request check selected type application/json response check body bytes 14 sent check match yes same type
Summary
Accept can ask for JSON, and the toy server can choose the matching response body.
Accept picks JSON \text{Accept picks JSON} Accept picks JSON Accept honesty boundary The selected response and body-length check are recomputed from pinned request and response bytes. Accept honesty boundary - GET /item selects application/json, body 14 bytes section name value check request line method GET parsed request line path /item parsed request line version HTTP/1.1 parsed header Host api.example exact header Accept application/json requested type variant 1 type text/html candidate variant 1 body display HTML paragraph cat safe display form variant 1 body hex 3c703e6361743c2f703e pinned bytes variant 1 body bytes 10 counted variant 1 match no Accept compare variant 2 type application/json candidate variant 2 body display JSON name cat safe display form variant 2 body hex 7b226e616d65223a22636174227d pinned bytes variant 2 body bytes 14 counted variant 2 match yes Accept compare status version HTTP/1.1 parsed status status 200 OK ok header Content-Type application/json selected header Content-Length 14 declared bytes body display words JSON name cat safe display form body exact hex 7b226e616d65223a22636174227d pinned bytes check Accept application/json request check selected type application/json response check body bytes 14 sent check match yes same type