5x sweep: /verify returns 200 for invalid/expired human links (was 400 → console error on a customer page); 503 kept for no_secret

e642d0dfad95edc976137423bd2326ab30fccae2 · 2026-08-14 16:38:01 -0700 · steve

Files touched

M server.js

Diff

commit e642d0dfad95edc976137423bd2326ab30fccae2
Author: steve <steve@designerwallcoverings.com>
Date:   Fri Aug 14 16:38:01 2026 -0700

    5x sweep: /verify returns 200 for invalid/expired human links (was 400 → console error on a customer page); 503 kept for no_secret
---
 server.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index c7118a5..00a5dfd 100644
--- a/server.js
+++ b/server.js
@@ -162,7 +162,11 @@ app.get('/verify', async (req, res) => {
     const msg = parsed.reason === 'expired'
       ? "This confirmation link has expired. Request a new one and we'll send a fresh link."
       : 'This confirmation link is invalid.';
-    return res.status(parsed.reason === 'no_secret' ? 503 : 400).type('html').send(verifyPage(msg, false));
+    // /verify is a human-facing page (a clicked email link), not an API. An invalid/expired
+    // token is a rendered outcome, not a malformed request → 200 (consistent with the
+    // completeVerification-failure page below, and avoids a console error on a customer page).
+    // Reserve a 5xx only for no_secret, which is a genuine server misconfiguration.
+    return res.status(parsed.reason === 'no_secret' ? 503 : 200).type('html').send(verifyPage(msg, false));
   }
   const done = await verify.completeVerification({ email: parsed.email, customerId: parsed.customerId });
   if (!done.ok) {

← 535e4f8 5x sweep 1: client-side email validation on /claim (empty su · back to Dw Signup Fulfillment · 5x RE-RUN 3: Option C /claim + /verify pages — 2 defects cau b32b988 →