badhttp.dev valid

badhttp

The server that misbehaves on purpose: a free, stateless catalogue of HTTP edge-case endpoints (slow responses, broken JSON, redirect loops, truncated bodies, flaky failures, SSE streams, range requests, conditional requests, Set-Cookie headers, HTTP authentication and content codings that misbehave) for testing HTTP clients, SDKs and agents, plus x402 paywalls (v2 and v1 in the same responses), one real and several that misbehave.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-25T19:11:01.016Z. Cached copy · Source on badhttp.dev

# badhttp

> The server that misbehaves on purpose: a free, stateless catalogue of HTTP edge-case endpoints (slow responses, broken JSON, redirect loops, truncated bodies, flaky failures, SSE streams, range requests, conditional requests, Set-Cookie headers, HTTP authentication and content codings that misbehave) for testing HTTP clients, SDKs and agents, plus x402 paywalls (v2 and v1 in the same responses), one real and several that misbehave.

Version 0.27.0. No signup, no API key, nothing stored about callers (the only cross-request state is edge-cached copies of our own on-chain balances and transfer list for /books). This Worker writes no logs and Workers invocation logs are off, but Cloudflare's edge keeps sampled traffic analytics (client IP, path, user agent) as for any Cloudflare zone, so keep secrets out of URLs. Every endpoint is deterministic unless the page says otherwise. Limits: /delay at most 10 s, /drip at most 20 s and 200 chunks, /echo reads the first 16 KB, /redirect at most 10 hops, /sse streams at most 20 s, /range documents at most 1048576 bytes and 8 ranges per request, /cookies at most 20 cookies per response from /cookies/many (the /cookies/delete cleanup sends 45 expirations) and 8192 bytes of cookie name+value (the Set-Cookie header itself runs ~30 bytes longer), /compress documents at most 1048576 bytes and /compress/bomb at most 32 MiB inflated. Redirect targets come from a fixed table of two hosts this project owns, badhttp.dev and alt.badhttp.dev: no endpoint accepts a redirect target, or any part of one, from the caller, so there is no open redirect here. Rate limit: 100 requests per 10 s per IP, enforced at the zone before the Worker runs; Cloudflare answers 429 (text/plain, error code 1015) with Retry-After. One edge block as well, since 2026-10-22: /compress/bomb answers 403 from the edge (not this Worker) to any request whose User-Agent contains "Mozilla/" (case-insensitive since 2026-10-23), because a flood of millions of fake-browser requests a day for the 32 MiB bomb, one or two per address through millions of addresses, made every one a billed Worker invocation (the cost is on https://badhttp.dev/books); and, since 2026-10-23, to any request whose ?size= values are not all among the exact strings 1-8 (an invalid value included) that lacks the header x-badhttp-bomb: accept, whatever its user agent or method, so that a flood which changes its browser string still costs nothing here. The block matches the claimed User-Agent, not the client: a browser, a browser driver, or a tool whose default user agent contains Mozilla/ (yt-dlp's does) must send another one to reach this flavor; clients with their own user agents are served as documented, and send the header for a bomb above 8 MiB. A documented path template requested literally with the braces intact (e.g. https://badhttp.dev/sse/{flavor}) answers 200 with the valid values for the placeholder, any method except OPTIONS.

Payment: only https://badhttp.dev/402
…

Machine-readable: GET /v1/resolve?q=badhttp.dev · GET /v1/domain/badhttp.dev · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for badhttp.dev:
1. POST https://agentwebmap.com/v1/sites/badhttp.dev/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://badhttp.dev/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/badhttp.dev/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/badhttp.dev).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.