APS-34Optional

Send a hash of the body

Send a Content-Digest, a hash of the response body, on files clients download to verify, such as Markdown copies and downloads. RFC 9530 defines it.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Compute the sha-256 and send it in the RFC 9530 format. Content-Digest covers the bytes as sent, after compression. For the uncompressed text, Unencoded-Digest is an IETF draft some agents read. Build the Markdown copies it covers as Offer every page as Markdown says.

Examples

HTTP example

HTTP/2 200
content-type: text/markdown; charset=utf-8
content-digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

Shell example

curl -s https://example.com/index.md | openssl dgst -sha256 -binary | openssl base64

How to check

Fetch the file without compression. The base64 SHA-256 of the body equals the value in its Content-Digest.

Sources

RFC 9530: Digest Fields

AGT-49 Offer every page as Markdown in Agents as users

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/digest-fields">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.