5x sweep 1: add auth-exempt /favicon.ico 204 route (kills per-load console 404)

d29d6ef4588edbb329c93ec6c062f6909ab77c62 · 2026-07-12 11:20:17 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit d29d6ef4588edbb329c93ec6c062f6909ab77c62
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:20:17 2026 -0700

    5x sweep 1: add auth-exempt /favicon.ico 204 route (kills per-load console 404)
---
 server.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 9e57e94..69de75d 100644
--- a/server.js
+++ b/server.js
@@ -63,7 +63,7 @@ const BASIC_AUTH = process.env.BASIC_AUTH || 'admin:DW2024!';
 const AUTH_HEADER = 'Basic ' + Buffer.from(BASIC_AUTH).toString('base64');
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 app.use((req, res, next) => {
-  if (req.path === '/healthz') return next();
+  if (req.path === '/healthz' || req.path === '/favicon.ico') return next();
   const remote = req.socket && req.socket.remoteAddress;
   const proxied = req.get('cf-connecting-ip') || req.get('x-forwarded-for');
   if (LOOPBACK.has(remote) && !proxied) return next();   // direct local access
@@ -72,6 +72,9 @@ app.use((req, res, next) => {
   res.status(401).send('auth required');
 });
 app.get('/healthz', (_req, res) => res.json({ ok: true, ts: new Date().toISOString() }));
+// No favicon asset shipped — return 204 (auth-exempt) so browsers stop 404ing on
+// the automatic /favicon.ico request (kills a console error on every page load).
+app.get('/favicon.ico', (_req, res) => res.status(204).end());
 
 app.use(express.static(path.join(__dirname, 'public')));
 app.get('/', (_req, res) => res.sendFile(path.join(__dirname, 'public', 'index.html')));

← d691649 chore: syntax-verified session changes, v0.1.1 → v0.2.0 (ses · back to Dw Pitch Followup · 5x: REPORT.md — 2 sweeps, app clean, M3 networkidle proven C 10b262d →