[ ] A signed-out GET of a server-rendered page (/, /signin, /signup, /explore) carries a weak ETag computed from the body bytes; a request with a matching If-None-Match answers 304 with no body and the same security headers.
[ ] Signed-in pages and any page with a per-request token (CSRF, nonce) are left alone, so a 304 never serves someone else's state; a test proves a signed-in page carries no ETag.
[ ] The etag entry is removed from WHY in test/forge-webspec.test.ts and the test passes.
Files: src/http/server.ts (or one small src/http/etag.ts), test/forge-webspec.test.ts, test/etag.test.ts.
Risk: the CSP nonce changes per response; if pages carry one, hash the body without it or skip those pages, and say which in the pull.
Part of #2915.
Done looks like:
ETagcomputed from the body bytes; a request with a matchingIf-None-Matchanswers 304 with no body and the same security headers.etagentry is removed from WHY in test/forge-webspec.test.ts and the test passes.Files: src/http/server.ts (or one small src/http/etag.ts), test/forge-webspec.test.ts, test/etag.test.ts. Risk: the CSP nonce changes per response; if pages carry one, hash the body without it or skip those pages, and say which in the pull.