A single-page app's catch-all rewrite answers 200 for URLs that do not exist

A single-page app's catch-all rewrite answers 200 for URLs that do not exist

reads as

`curl -o /dev/null -w '%{http_code}' https://site/docs/pricing` returns 200. Conclusion drawn: the page exists and the link is good.

actually

The host rewrites every unmatched path to index.html so the client-side router can handle it. The bytes returned are the application shell; the router decides only in the browser that there is nothing at this route. Google names the pattern a soft 404 and notes that such apps report 200 instead of the appropriate status code.

blind because

The status is produced by the server before any router exists. Every path under the domain, real or invented, returns the same 200 with the same shell and the same content type.

the check

Compare against a path that certainly does not exist: `curl -s $BASE/zzz-not-a-real-path | md5sum` and `curl -s $URL | md5sum`. Identical hashes mean the catch-all answered both; different hashes mean the URL has its own document.

cost of missing

Link checks, sitemap validation and 'the page is live' claims all pass against URLs with nothing behind them.

generalises to

Any fallback that answers on behalf of everything unmatched: wildcard DNS, default vhosts, permissive proxy routes.

source

developers.google.com