diff --git a/pando/state_chain.py b/pando/state_chain.py
index 9fb57a43..f7e60513 100644
--- a/pando/state_chain.py
+++ b/pando/state_chain.py
@@ -27,7 +27,7 @@ import traceback
 
 from aspen import resources
 from aspen.exceptions import NotFound, Redirect, UnindexedDirectory
-from aspen.http.resource import NegotiationFailure
+from aspen.http.resource import Static, NegotiationFailure
 from aspen.request_processor.dispatcher import DispatchResult, DispatchStatus
 from first import first as _first
 
@@ -108,21 +108,26 @@ def create_response_object(state):
     state.setdefault('response', Response())
 
 
-@_import_from('aspen.request_processor.algorithm')
-def render_resource():
-    pass
-
-
-def fill_response_with_output(output, response, request_processor):
-    if not isinstance(output.body, bytes):
-        output.charset = request_processor.encode_output_as
-        output.body = output.body.encode(output.charset)
-    response.body = output.body
+def render_response(state, resource, response, request_processor):
+    if isinstance(resource, Static):
+        if state['request'].method == 'GET':
+            response.body = resource.raw
+        elif state['request'].method == 'HEAD':
+            response.headers[b'Content-Length'] = str(len(resource.raw)).encode('ascii')
+        else:
+            raise Response(405)
+        media_type, charset = resource.media_type, resource.charset
+    else:
+        output = resource.render(state)
+        if not isinstance(output.body, bytes):
+            output.charset = request_processor.encode_output_as
+            output.body = output.body.encode(output.charset)
+        media_type, charset = output.media_type, output.charset
+        response.body = output.body
     if b'Content-Type' not in response.headers:
-        ct = output.media_type
-        if output.charset:
-            ct += '; charset=' + output.charset
-        response.headers[b'Content-Type'] = ct.encode('ascii')
+        if charset:
+            media_type += '; charset=' + charset
+        response.headers[b'Content-Type'] = media_type.encode('ascii')
 
 
 def get_response_for_exception(website, exception):
@@ -185,8 +190,7 @@ def delegate_error_to_simplate(website, state, response, request=None, resource=
         wanted += ',text/plain;q=0.2,*/*;q=0.1'
         state['accept_header'] = wanted.lstrip(',')
 
-        output = resource.render(state)
-        fill_response_with_output(output, response, website.request_processor)
+        render_response(state, resource, response, website.request_processor)
 
 
 def log_traceback_for_exception(website, exception):

Requests for static files should return a 405 if method is unsafe
Reticketing from <https://github.com/AspenWeb/aspen.py/issues/50>.

Any request for a static file with a method other than `GET` or `HEAD` should be rejected with a 405.
diff --git a/tests/test_website_flow.py b/tests/test_website_flow.py
index 0916e3c5..1d5d9966 100644
--- a/tests/test_website_flow.py
+++ b/tests/test_website_flow.py
@@ -46,3 +46,30 @@ def test_early_failures_dont_break_everything(harness):
         assert harness.client.GET("/", raise_immediately=False).code == 400
     finally:
         Request.from_wsgi = old_from_wsgi
+
+
+def test_static_resource_GET(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.GET('/file.js')
+    assert r.code == 200
+    assert r.body == b"Hello world!"
+
+
+def test_static_resource_HEAD(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.HEAD('/file.js')
+    assert r.code == 200
+    assert not r.body
+    assert r.headers[b'Content-Length'] == b'12'
+
+
+def test_static_resource_PUT(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.PxT('/file.js', body=b'Malicious JS code.')
+    assert r.code == 405
+
+
+def test_static_resource_unknown_method(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.hxt('UNKNOWN', '/file.js')
+    assert r.code == 405

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pyflakes
3.6
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
algorithm==1.2.0
aspen==1.0rc3
attrs==22.2.0
certifi==2021.5.30
dependency-injection==1.2.0
filesystem-tree==1.1.2
first==2.0.2
importlib-metadata==4.8.3
iniconfig==1.1.1
packaging==21.3
-e git+https://github.com/AspenWeb/pando.py.git@0e0bc40453df28bae014461822fa25daf8263ff8#egg=pando
pluggy==1.0.0
py==1.11.0
pyflakes==3.0.1
pyparsing==3.1.4
pytest==7.0.1
python-mimeparse==1.6.0
six==1.17.0
tomli==1.2.3
typing_extensions==4.1.1
zipp==3.6.0

name: pando.py
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - algorithm==1.2.0
      - aspen==1.0rc3
      - attrs==22.2.0
      - dependency-injection==1.2.0
      - filesystem-tree==1.1.2
      - first==2.0.2
      - importlib-metadata==4.8.3
      - iniconfig==1.1.1
      - packaging==21.3
      - pluggy==1.0.0
      - py==1.11.0
      - pyflakes==3.0.1
      - pyparsing==3.1.4
      - pytest==7.0.1
      - python-mimeparse==1.6.0
      - six==1.17.0
      - tomli==1.2.3
      - typing-extensions==4.1.1
      - zipp==3.6.0
prefix: /opt/conda/envs/pando.py

tests/test_website_flow.py::test_static_resource_HEAD tests/test_website_flow.py::test_static_resource_PUT tests/test_website_flow.py::test_static_resource_unknown_method
tests/test_website_flow.py::test_website_can_respond tests/test_website_flow.py::test_website_can_respond_with_negotiation tests/test_website_flow.py::test_404_comes_out_404 tests/test_website_flow.py::test_user_can_influence_request_context_via_algorithm_state tests/test_website_flow.py::test_early_failures_dont_break_everything tests/test_website_flow.py::test_static_resource_GET
pando/state_chain.py
pando/state_chain.py