Contentlesshtml – An HTML page served entire in HTTP headers

It does not really work on all browsers, but I can imagine scenarios where in some network middleware you have some dynamic control over headers but don't have control over the content, so that might be once place something like this could be useful.

afavour• 2 years ago

Does there need to be one? It raises awareness of the headers used, even if they’re used weirdly here.

cryptonym2• 2 years ago

One could leverage this as a clever way to update something on a page without redownloading it. Or from a proxy, without having to decompress & process body. Unfortunately support is limited to Firefox, so it's useless.

maxmcd• 2 years ago

I think if you go above 32kb for the size of all headers you'll start to see things breaking in various libraries and services.

ruthmarx2• 2 years ago

Why isn't it being assembled as HTML that can be viewed in document inspector or via viewing source? Ht HTML that extensions inspect shows up. If it is assembled to be rendered, why isn't it available anywhere else in the browser to view?

jansan• 2 years ago

It's using CSS, specifically the `content` property. You can use developer tools in Firefox to inspect it.

ruthmarx2• 2 years ago

ah, thanks!

kroltan• 2 years ago

And to spell it out:

- Stylesheet encoded as base64 in the Link header;

- Browsers always implicitly have at least the html and body tags;

- CSS cannot create new elements, but it does get 2 free pseudo-elements per actual element, ::before and ::after;

- CSS can set textual content for pseudo-elements;

So, it sets content to a pseudo element of an implicitly created tag, that's why the page is so minimal.

(Well, it could be up to 4 times as complicated I think, by using the other 3 pseudo-elements. Or cheat by using a big SVG as a background-image with more complex contents, but then you start running into header size limits and whatnot)

selcuka• 2 years ago

TL; DR: It uses the HTTP link header [1] in a way that only works on some browsers:

    link <data:text/css;charset=utf-8;base64,KiB7CiAgICBiYWNrZ3JvdW5kLWNvbG9yOiBjeWFuOwp9Cgpib2R5OjphZnRlciB7CiAgY29udGVudDogIkhpISBUaGlzIGlzIHNlcnZlZCBlbnRpcmVseSBpbiB0aGUgSFRUUCBoZWFkZXJzISBQcmV0dHkgY29vbCwgaHVoPyI7CiAgZm9udC1zaXplOiAyNHB4OwogIGZvbnQtZmFtaWx5OiBjdXJzaXZlOwogIHRleHQtc2hhZG93OiAycHggMnB4IDJweCBwaW5rOwp9Cg==>; rel="stylesheet"

which is, when base64-decoded:

    * {
        background-color: cyan;
    }

    body::after {
      content: "Hi! This is served entirely in the HTTP headers! Pretty cool, huh?";
      font-size: 24px;
      font-family: cursive;
      text-shadow: 2px 2px 2px pink;
    }

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Li...

xnx• 2 years ago

Blank rickroll site from 3 years ago using same technique: https://github.com/PwnFunction/Blank-Rick-Roll

bhhaskin• 2 years ago

Isn't every webpage served by http headers? =P

Contentlesshtml – An HTML page served entire in HTTP headers

Related Stories