fix(hosting): JSON 500 keeps correlation id; no session cookie for anonymous API calls

[antosubash]

Fixes #346
Fixes #349

#346: JSON for unhandled 500 / NotFoundError

On current main the three handlers (validation, NotFoundError, unhandled) already share the _wants_json negotiation (/api/* or non-HTML Accept gets JSON; X-Inertia and browser navigations keep the Inertia page). What was still wrong:

• The 500 handler runs in Starlette's ServerErrorMiddleware, which wraps outside CorrelationIdMiddleware, so the 500 response (JSON or page) never carried X-Correlation-ID - the one handle the issue says clients have. unhandled_exception_handler now sets it from request.state.correlation_id.
• No regression test covered the unhandled / NotFoundError paths end to end; added.

#349: no session cookie for anonymous API calls

build_i18n_block stores __i18n_locale / __i18n_audience in the session so a later Inertia XHR can tell "locale/audience unchanged" and skip re-sending the message catalog (messages: None). It wrote them unconditionally, so every anonymous response (API, health, ...) got a Set-Cookie, which makes it uncacheable by shared caches.

Fix: only persist when it can pay off, i.e. when the session already has data (a cookie was presented), or the request is an Inertia request, or it accepts text/html (a page navigation). A cookie-less bare API/health call writes nothing, so no Set-Cookie. Chosen over a path-prefix rule because it needs no knowledge of route layout and keeps real browser sessions (which send Accept: text/html on first load) behaving exactly as before. Reading the plain-dict session does not mark it accessed here, and no Vary: Cookie appears (asserted in tests).

One existing test seeded the session with a */* GET and expected persistence; it now sends Accept: text/html like a real page load.

Tests

framework/hosting/tests/test_hosting_error_json_and_session_cookie.py: JSON 500 on /api (with correlation id), HTML 500 on a page, JSON/HTML NotFoundError, anonymous /api and /health have no set-cookie/Vary: Cookie, anonymous page load still sets the session.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-05T10:14:28.609378Z	1e7d142	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	1e7d142
Status:	✅  Deploy successful!
Preview URL:	https://e5bdbec1.simple-module-python.pages.dev
Branch Preview URL:	https://fix-hosting-error-json-and-l.simple-module-python.pages.dev

View logs

[antosubash]

/ship results

Converged, no code changes needed. Head unchanged (1e7d142).

• Optimize: nothing to do (about 30 source lines).
• Code review (1 pass, high): 3 findings, all accepted. Low: _accepts_html is a substring test, so Accept: text/html;q=0, application/json is treated as page-shaped and still gets the cookie. Info: catalog re-sent once for a client that goes API call then Inertia XHR; correlation id echoed unvalidated (same as the middleware).
• Checked: locale changes still persist and ship messages for sessions with data; first loads still ship messages (when persisting is skipped, last_locale stays unset so Inertia loads re-ship); other middleware read the session via scope.get, which doesn't set accessed, so no Vary: Cookie for anonymous API calls; 500 negotiation correct for JSON / HTML / Inertia.
• QA (API 8100 / Vite 5250, temporary uncommitted /api/_qa/boom and /_qa/boom routes): 0 bugs. Anonymous /api/* and /health (no Accept, */*, JSON; GET/POST/HEAD/OPTIONS) have no Set-Cookie and no Vary: Cookie. Anonymous page loads and X-Inertia get the session cookie. /admin first load ships 1216 messages, later Inertia fetches ship none. 500s: JSON for API clients, HTML page for browsers, Error component for X-Inertia (real router.visit renders in-app and recovers); X-Correlation-ID on all.
• Not exercised in the UI: language switching. Only en is installed (no picker, set-locale with es returns 422); the switch-then-next-visit path is covered by test_inertia_i18n_shared_props.py.
• P3 observations: application/json, text/html Accept also gets the cookie on JSON endpoints; authenticated API responses re-set the session cookie (pre-existing).
• CI: make lint passed; make test-py 3578 passed, 9 skipped.

Overlap with #410 (file_storage/cookieless.py)

Same root cause (i18n/layout code writing locale and audience into the session, minting Set-Cookie), different layer. #401 stops the write at the source for session-less, non-page requests; #410 clears Starlette's accessed/modified flags on a path-matched response. Not redundant: a browser opening a public file URL directly sends Accept: text/html, which #401 treats as page-shaped, and #410 also drops Vary: Cookie for any other session reader. Suggest after both merge: keep #410's behaviour but generalise it into a hosting-level opt-out (a public-route flag, e.g. alongside register_public_routes) so modules don't carry their own regex middleware. No change made to #410.

Report: https://claude.ai/artifact/THScuf1T9WEdayCMV9Cibh

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4