Serve standard files at fixed addresses

How to do it

Serve each file at its exact registered path, with its content type and no redirect to a sign-in page. Add Access-Control-Allow-Origin: * (CORS, which lets other sites read it) on files meant for agents and other sites. Answer 404 for every name you do not publish. Never fall back to the home page, as single-page apps often do, because clients then read HTML as data. IANA keeps the list of registered names. security.txt is covered in the security chapter.

Example

location ^~ /.well-known/ {
  add_header Access-Control-Allow-Origin "*" always;
}
location = /.well-known/api-catalog {
  default_type application/linkset+json;
  add_header Access-Control-Allow-Origin "*" always;
}

curl -sI https://example.com/.well-known/api-catalog

How to check

Fetch each file without cookies. Each returns 200 with the right type, and CORS where intended. A made-up name such as /.well-known/no-such-file returns 404.