# Fix: Negotiated responses carry Vary Accept, User-Agent

> Web-audit fix skill for the `markdown-vary` check (Content for agents, SHOULD).

## Goal

Emit Vary Accept, User-Agent so shared caches never serve one client the wrong variant.

## Fix

When the same URL serves HTML or markdown depending on the request, emit
`Vary: Accept, User-Agent` on every response. Without it a shared cache (a CDN or a corporate
proxy) can store the markdown twin under the bare URL and then hand it to a browser, or vice
versa. Listing both request headers you negotiate on tells every cache to key its stored copies
by them, so each client class gets the variant it asked for. If the CDN ignores or strips Vary
(Cloudflare's zone cache historically keeps only `Accept-Encoding`), do not give that cache a
long `s-maxage` on negotiated responses — otherwise HIT replies reach clients with no Vary and
the check still fails.

## Resources

- [RFC 9110 (Vary)](https://www.rfc-editor.org/rfc/rfc9110#name-vary)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Emit Vary Accept, User-Agent so shared caches never serve one client the wrong variant
Fix: When the same URL serves HTML or markdown depending on the request, emit `Vary: Accept, User-Agent` on every response. Without it a shared cache (a CDN or a corporate proxy) can store the markdown twin under the bare URL and then hand it to a browser, or vice versa. Listing both request headers you negotiate on tells every cache to key its stored copies by them, so each client class gets the variant it asked for. If the CDN ignores or strips Vary (Cloudflare's zone cache historically keeps only `Accept-Encoding`), do not give that cache a long `s-maxage` on negotiated responses — otherwise HIT replies reach clients with no Vary and the check still fails.
Skill: https://anc.dev/fix/markdown-vary
Docs: https://www.rfc-editor.org/rfc/rfc9110#name-vary
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `markdown-vary` check should report `pass`.