ACME does not include the expected response in the path or query. So it can't be accidentally included in the response. EDIT: quote by Nick Lamb in the discuss

ACME does not include the expected response in the path or query. So it can't be accidentally included in the response. EDIT: quote by Nick Lamb in the discussion linked: > ACME http-01 won't get tripped here because the checked content of the URL is very much not the random string (it's a JWS signature over a data structure containing that random string, thereby proving it was made by whoever the ACME server is talking to). But yes, doing something that _looks_ superficially like the ACME style of validation without such subtlety will trip you up.