Skip to content

fix: implement hard 404 responses for invalid .json/ URL paths and empty taxonomy pages - #940

Closed
balpreetgrowthnatives wants to merge 2 commits into
Comfy-Org:mainfrom
balpreetgrowthnatives:fix/hard-404-json
Closed

fix: implement hard 404 responses for invalid .json/ URL paths and empty taxonomy pages#940
balpreetgrowthnatives wants to merge 2 commits into
Comfy-Org:mainfrom
balpreetgrowthnatives:fix/hard-404-json

Conversation

@balpreetgrowthnatives

Copy link
Copy Markdown
Collaborator

Summary

This PR addresses soft 404 flags by ensuring that the Astro site's server-side rendered (SSR) dynamic pages return a hard 404 HTTP status code (instead of rendering a blank UI shell with 200 OK or triggering a 302 redirect) when a request is made with invalid data, an empty taxonomy, or an appended trailing slash.

Changes Made

  • Early Truncation Check: Added a check for Astro.url.pathname.endsWith('.json/') at the top of the dynamic pages' frontmatter to return a hard 404 Response immediately, blocking bad trailing slash Vercel redirects from matching dynamic layouts.
  • Workflow Detail Pages: Updated dynamic pages to return a hard 404 response on missing workflow detail/data or database fetch errors.
  • Taxonomy Pages: Changed empty/invalid checks for categories, models, and tags on localized dynamic routes to return a hard 404 response instead of redirecting or returning a 200 OK blank layout.
    • Modified files:
      • [username].astro
      • [slug].astro
      • [type].astro
      • [name].astro
      • [tag].astro

Verification

  • Verified by running SKIP_AI_GENERATION=true npm run build successfully on the local environment.

@coderabbitai

coderabbitai Bot commented Jun 15, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Five Astro workflow route pages replace Astro.redirect calls with explicit HTTP 404 Response objects across three patterns: .json/-suffixed path requests, invalid type parameters, and routes where no matching templates or content exist. API failures now distinguish between missing content (404 Not Found) and transient errors (502 Bad Gateway with cache-control directives), while the creator profile page adds try/catch error tracking to properly classify index fetch failures.

Changes

Workflow Pages: Redirect → 404 Hardening

Layer / File(s) Summary
Early .json/ path guards
site/src/pages/[locale]/workflows/[slug].astro, site/src/pages/[locale]/workflows/category/[type].astro, site/src/pages/[locale]/workflows/model/[name].astro, site/src/pages/[locale]/workflows/tag/[tag].astro, site/src/pages/workflows/[username].astro
Each page receives an early guard that checks whether the request pathname ends with .json/ and immediately returns a 404 Not Found Response. No more .json/ shenanigans—these paths redirect to nowhere!
Localized pages: Type validation and empty-content detection
site/src/pages/[locale]/workflows/category/[type].astro, site/src/pages/[locale]/workflows/model/[name].astro, site/src/pages/[locale]/workflows/tag/[tag].astro, site/src/pages/[locale]/workflows/[slug].astro
The category page validates the type parameter and returns 404 for invalid/missing types instead of redirecting. All four localized pages now return 404 when template queries return empty results. Unused SerializedTemplate type imports are cleaned up across these pages.
API failure handling and error tracking
site/src/pages/[locale]/workflows/[slug].astro, site/src/pages/workflows/[username].astro
Detail API calls now return 404 Response for 404 errors and 502 Bad Gateway for non-404 failures (with CDN-Cache-Control: no-store). The creator profile page wraps index fetch calls in try/catch to distinguish API failures from missing content, returning 502 if the fetch failed or 404 if no results matched—no redirects for these slip-ups!
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@site/src/pages/`[locale]/workflows/[slug].astro:
- Around line 71-74: The current error handling in both files is incorrectly
returning a 404 status for all upstream detail-fetch failures, regardless of the
actual failure type. At site/src/pages/[locale]/workflows/[slug].astro lines
71-74, check the is404 flag or variable to distinguish between true not-found
errors and other dependency/upstream failures: if is404 is true, return the 404
response as currently implemented; otherwise, log the actual error and return a
503 or 502 response to properly indicate a server error. Apply the identical
error mapping logic at site/src/pages/workflows/[username].astro lines 60-63 to
ensure consistent handling across both creator routes and prevent false
hard-404s for non-404 upstream failures.
- Around line 143-146: The 404 response fallback does not distinguish between a
genuine missing resource and an upstream fetch failure, which masks service
outages. At site/src/pages/[locale]/workflows/[slug].astro lines 143-146
(anchor), add a check for successful upstream fetch status before returning the
404 response; if the fetch failed, return a 5xx status instead to indicate a
server error. Apply the identical fetch-status gating logic at the sibling
location site/src/pages/workflows/[username].astro lines 110-113 before
returning its hard 404 response. This ensures that ambiguous absence (caused by
fetch failures) is properly distinguished from genuine 404 scenarios.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 81650f30-614f-4838-be2a-24d58e5c5501

📥 Commits

Reviewing files that changed from the base of the PR and between 064febf and 434dbc3.

📒 Files selected for processing (5)
  • site/src/pages/[locale]/workflows/[slug].astro
  • site/src/pages/[locale]/workflows/category/[type].astro
  • site/src/pages/[locale]/workflows/model/[name].astro
  • site/src/pages/[locale]/workflows/tag/[tag].astro
  • site/src/pages/workflows/[username].astro

Comment thread site/src/pages/[locale]/workflows/[slug].astro
Comment thread site/src/pages/[locale]/workflows/[slug].astro
@balpreetgrowthnatives
balpreetgrowthnatives force-pushed the fix/hard-404-json branch 2 times, most recently from 434dbc3 to 52862d7 Compare June 15, 2026 11:47

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
site/src/pages/[locale]/workflows/category/[type].astro (1)

133-152: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Remove unreachable “no templates” UI branch.

Since Line 64-69 already returns 404 for templates.length === 0, the fallback branch here cannot execute. Pruning it will keep behavior clear and reduce maintenance drift.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@site/src/pages/`[locale]/workflows/category/[type].astro around lines 133 -
152, The fallback branch of the ternary operator that displays the "No templates
found" message is unreachable because an earlier check at Line 64-69 already
returns a 404 response when templates is empty. Remove this dead code by
simplifying the conditional to render only the WorkflowGrid component directly
without the ternary operator, since the function will have already exited with a
404 if templates.length === 0.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@site/src/pages/`[locale]/workflows/[slug].astro:
- Around line 70-73: 502 error responses are being cached due to inherited
page-level CDN cache policy, allowing temporary upstream failures to be replayed
from cache. Add explicit no-store semantics to prevent caching at all four
affected locations: In site/src/pages/[locale]/workflows/[slug].astro at lines
70-73, add headers: { 'CDN-Cache-Control': 'no-store' } to the detail-fetch 502
Response object. In site/src/pages/[locale]/workflows/[slug].astro at lines
149-152, add the same no-store header to the bogus-slug/index-failure 502
Response object. In site/src/pages/workflows/[username].astro at lines 59-62,
add no-store header to the detail-fetch 502 Response object. In
site/src/pages/workflows/[username].astro at lines 117-120, add no-store header
to the bogus-slug/index-failure 502 Response object.

---

Outside diff comments:
In `@site/src/pages/`[locale]/workflows/category/[type].astro:
- Around line 133-152: The fallback branch of the ternary operator that displays
the "No templates found" message is unreachable because an earlier check at Line
64-69 already returns a 404 response when templates is empty. Remove this dead
code by simplifying the conditional to render only the WorkflowGrid component
directly without the ternary operator, since the function will have already
exited with a 404 if templates.length === 0.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 43826dfe-ee74-419d-b119-1314f3abdf8a

📥 Commits

Reviewing files that changed from the base of the PR and between 434dbc3 and 52862d7.

📒 Files selected for processing (5)
  • site/src/pages/[locale]/workflows/[slug].astro
  • site/src/pages/[locale]/workflows/category/[type].astro
  • site/src/pages/[locale]/workflows/model/[name].astro
  • site/src/pages/[locale]/workflows/tag/[tag].astro
  • site/src/pages/workflows/[username].astro

Comment thread site/src/pages/[locale]/workflows/[slug].astro
@balpreetgrowthnatives
balpreetgrowthnatives force-pushed the fix/hard-404-json branch 2 times, most recently from 64e9bfa to b89f1ae Compare June 15, 2026 11:57

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@site/src/pages/`[locale]/workflows/category/[type].astro:
- Around line 64-69: The early 404 response guard checking if templates.length
=== 0 prevents the empty-state template fallback UI from ever being rendered,
making that code unreachable. Remove the guard that returns a 404 response when
templates is empty so that the "No templates found" message and fallback UI can
be displayed to users when there are no templates available.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b4694b03-2377-4ed7-99ac-2307025f6351

📥 Commits

Reviewing files that changed from the base of the PR and between 52862d7 and b89f1ae.

📒 Files selected for processing (5)
  • site/src/pages/[locale]/workflows/[slug].astro
  • site/src/pages/[locale]/workflows/category/[type].astro
  • site/src/pages/[locale]/workflows/model/[name].astro
  • site/src/pages/[locale]/workflows/tag/[tag].astro
  • site/src/pages/workflows/[username].astro

Comment thread site/src/pages/[locale]/workflows/category/[type].astro
@balpreetgrowthnatives

Copy link
Copy Markdown
Collaborator Author

I have read and agree to the Contributor License Agreement

@balpreetgrowthnatives

balpreetgrowthnatives commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@gouravsethi89

Copy link
Copy Markdown

@nav-tej @christian-byrne could you please check this?

@dante01yoon dante01yoon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: This head no longer merges cleanly into current main, so it is not safe to land as reviewed. A test merge against origin/main (bbe3015) conflicts in site/src/pages/[locale]/workflows/model/[name].astro and site/src/pages/workflows/[username].astro.

These are semantic conflicts, not just formatting: current main resolves model families and preserves variant-slug 301 redirects, and creator serialization now passes rankingMap. Please rebase/merge current main, keep the family/alias redirect behavior and ranking-aware serializeIndexEntry(..., rankingMap), then reapply the hard-404/502 behavior around those current paths.

The standalone PR head otherwise passes astro check, focused ESLint, and astro build; the blocker is integration with current main and the regression risk in resolving these conflicts.

@socket-security

socket-security Bot commented Jul 24, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Jul 24, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/pnpm-lock.yamlnpm/vitest@4.1.10npm/@tailwindcss/vite@4.3.3npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @internationalized/date is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/pnpm-lock.yamlnpm/reka-ui@2.10.1npm/@internationalized/date@3.12.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@internationalized/date@3.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm astro is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/package.jsonnpm/astro@5.18.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@5.18.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm css-tree is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/pnpm-lock.yamlnpm/astro@5.18.2npm/css-tree@3.2.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm web-vitals is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/pnpm-lock.yamlnpm/posthog-js@1.407.2npm/web-vitals@5.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/web-vitals@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm yargs is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: site/pnpm-lock.yamlnpm/@astrojs/check@0.9.9npm/yargs@17.7.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@balpreetgrowthnatives

Copy link
Copy Markdown
Collaborator Author

Rebased on current main (bbe3015) and resolved the semantic conflicts. Maintained model family resolution & variant 301 redirects in model/[name].astro, kept rankingMap serialization in creator routes, and reapplied the hard 404/502 and .json/ path blocking. Verified clean with astro check, eslint, and astro build. Ready to review/land!

@nav-tej

nav-tej commented Jul 24, 2026 via email

Copy link
Copy Markdown
Contributor

@mobeenabdullah

Copy link
Copy Markdown
Contributor

@dante01yoon @DrJKL @christian-byrne @deepme987 could any of you please review and approve this again?

mobeenabdullah added a commit that referenced this pull request Jul 28, 2026
…ost of #940) (#1048)

Co-authored-by: Balpreet Brar <balpreet.brar@growthnatives.com>
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 30, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants