HEAD reveals paid metadata
Quirk · GET /api/x402/head-leak · Web / HTTP Layer
A HEAD request returns 200 with a leak header and no payment.
Explanation
A HEAD request returns 200 with a leak header and no payment, exposing paid metadata to anyone who probes the endpoint. The merchant must gate HEAD the same way as GET.
What to watch
Try curl -I against this path.
Facilitator
Settled against the live Radius testnet facilitator (https://facilitator.testnet.radiustech.xyz). A valid payment runs a real /verify and /settle on-chain.
Metadata
- Status: Quirk
- Method: GET
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant