From 366e120a05fd0b7f01899f752b3927a5fbb843e5 Mon Sep 17 00:00:00 2001
From: Ian Gulliver <github@flamingcow.io>
Date: Thu, 20 Aug 2026 12:59:47 -0700
Subject: [PATCH] Buffer the login page so HEAD requests skip the body write

---
 internal/auth/auth.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 3033923..6994eaa 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -2,6 +2,7 @@
 package auth
 
 import (
+	"bytes"
 	"context"
 	"crypto/hmac"
 	"crypto/sha256"
@@ -95,13 +96,18 @@ func (a *Auth) loginPage(w http.ResponseWriter, r *http.Request) {
 	if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
 		scheme = "https"
 	}
-	err = t.Execute(w, map[string]string{
+	var page bytes.Buffer
+	err = t.Execute(&page, map[string]string{
 		"ClientID": a.clientID,
 		"LoginURI": scheme + "://" + r.Host + "/auth/login",
 	})
 	if err != nil {
 		log.Printf("[ERROR] render login page: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
 	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(page.Bytes()))
 }
 
 func (a *Auth) login(w http.ResponseWriter, r *http.Request) {