add 404-guard for unknown routes (stops .bak/.pre-* path probes from leaking stack traces)

e25f6ecc2c1ea4b9c3f06bd30153782b22893d8a · 2026-05-25 21:20:22 -0700 · steve

Files touched

M server.js

Diff

commit e25f6ecc2c1ea4b9c3f06bd30153782b22893d8a
Author: steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:20:22 2026 -0700

    add 404-guard for unknown routes (stops .bak/.pre-* path probes from leaking stack traces)
---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index f51f654..da1b192 100644
--- a/server.js
+++ b/server.js
@@ -241,6 +241,13 @@ ${urls.map(u => `  <url><loc>https://micawallpaper.com${u}</loc><changefreq>week
 // Admin catalog CRUD — /admin/catalog (basic-auth) + /api/admin/* REST.
 if (catalog) catalog.mount(app, { siteSlug: SITE_SLUG, rails: SITE_RAILS });
 
+// 404-guard — keep stray .bak/.pre-* paths and other unknown routes from leaking
+// stack traces or directory listings. Mount LAST so real routes win.
+app.use((req, res) => {
+  if (req.path.startsWith('/api/')) return res.status(404).json({ error: 'not_found', path: req.path });
+  res.status(404).type('html').send('<!doctype html><meta charset=utf-8><title>Not found · micawallpaper</title><body style="font:14px/1.6 -apple-system,system-ui,sans-serif;max-width:560px;margin:80px auto;padding:0 24px;color:#1a1714"><h1 style="font:400 28px/1.1 Playfair Display,Georgia,serif;font-style:italic">Not found</h1><p>The page you requested doesn’t exist on micawallpaper.com.</p><p><a href="/" style="color:#b8a87c">← back to the archive</a></p></body>');
+});
+
 // Load the catalog. When admin is enabled, prefer dw_unified; else static JSON.
 (async () => {
   let loaded = false;

← 30ba01a /api/facets total counts FILTERED list (accept q + aesthetic · back to Micawallpaper · site.config rails: align with actual catalog buckets (silver 702414f →