Invalid URLs return HTTP Status Code 200

[arch1v1st]

Is it a duplicated question?
No

Describe the bug
Any invalid URL returns a HTTP status code of 200 with a white blank page. This terrible for SEO as well as 'bad bots' looking for vulnerabilities.

To Reproduce
Inspect the page > Network Tab > Load any URL (i.e. https://UKDOMAIN.COM/badurl)

Expected behavior
Should return a 404, or if accessing valid URLs like '/dashboard' or '/settings' while not authenticated, return a 403 or 302 and redirect the user to a login page.

Info
Uptime Kuma Version: 1.9.1
Using Docker?: No
Docker Version: N/A
Node.js Version (Without Docker only): v14.18.0
OS: Ubuntu
Browser: Any

Other:
Running nginx as a proxy in front of Express.

[louislam]

Since Uptime Kuma is a single page application (SPA), technically the server always return index.html and it must be 200.

I can add a error message in the frontend, but it is not a real 404 response.

So I might need some advise on this part. How is SPA telling Google that is an error page?

[arch1v1st]

Here is the most thorough resource I've found on the topic, so far!

https://thegray.company/blog/single-page-application-spas-404s-seo

[CommanderStorm]

This terrible for SEO

Why is SEO relevant for a status page/uptime monitor?
Why do you think this is terrible for SEO? If a site is not being linked to (i.e. the case where you would like a 404), it will not be found by google/…

'bad bots' looking for vulnerabilities.

Given that always returning the same code+content is leaking zero state, how is this relevant?

[CommanderStorm]

Given that the blank screen has been fixed in #1633 Is this resolved?

[Electrenator]

Given that the blank screen has been fixed in #1633 Is this resolved?

Yes seems like it appart from the blank pages generated with unknown status pages like /status/an-invalid-monitor or just /status currently on 1.21.3.

[g0tmi1k]

Using v1.22.1, it no longer gives a blank white page - but the HTTP response code is still HTTP 200 (and not HTTP 404).

Example.

Setting up uptime-kuma:

~ % docker run -p 3001:3001 louislam/uptime-kuma:1.22.1-debian
[...]

In a new terminal, requesting the landing page, gives a HTTP 302, to redirect to /dashboard:

~ % curl -I 'http://localhost:3001/'
HTTP/1.1 302 Found
X-Frame-Options: SAMEORIGIN
Location: /dashboard
Vary: Accept
Content-Type: text/plain; charset=utf-8
Content-Length: 32
Date: Fri, 07 Jul 2023 16:33:01 GMT
Connection: keep-alive
Keep-Alive: timeout=5

~ %

Manually following, you get a HTTP 200:

~ % curl -I 'http://localhost:3001/dashboard'
HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8
Content-Length: 1946
ETag: W/"79a-yf0yFUVMYYPB3gvxhw/9zau//z0"
Date: Fri, 07 Jul 2023 16:34:08 GMT
Connection: keep-alive
Keep-Alive: timeout=5

~ %

Now, requesting something that doesn't exists, also gives HTTP 200, rather than HTTP 404:

~ % curl -I 'http://localhost:3001/badpath'
HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8
Content-Length: 1946
ETag: W/"79a-yf0yFUVMYYPB3gvxhw/9zau//z0"
Date: Fri, 07 Jul 2023 16:35:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5

~ %

[chakflying]

Marking this as Wont fix since this is a fundamental limitation of the current architecture.