Infinite loop when middleware creates a 404 response

[lilnasy]

Astro Info

Astro                    v4.5.17
Node                     v20.11.1
System                   Windows (x64)
Package Manager          unknown
Output                   static
Adapter                  none
Integrations             none

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Quoting #8100 (comment)

...there is no way now to return any 404 in the middleware, it always ends up in an infinite loop, even if I create a static 404 page. I'm now forced to diverge from security best practices and return a 403 instead. This way there is no endless loop.

What's the expected result?

Server does NOT recursively call itself. Context: "Recursive rerouting" section of withastro/roadmap#681.

Link to Minimal Reproducible Example

astro/packages/astro/test/fixtures/custom-404-loop-case-3/src/middleware.js

Line 4 in 2acea4d

return new Response(response.body, { ...response, status: 404 })

(skipped in #10084)

astro/packages/astro/test/custom-404-implicit-rerouting.test.js

Lines 35 to 36 in 2acea4d

	it.skip(
	'dev server stays responsive',

Participation

• I am willing to submit a pull request for this issue.

[lilnasy]

@kyr0 Did you encounter the loop in production with the node adapter or just the dev server?

[lilnasy]

The tests passed with the test adapter. Confirming that the node adapter is unaffected before closing.

[lilnasy]

Unaffected.

[kyr0]

@lilnasy This happens in development with the Node adapter and affects a production deployment with the Vercel adapter, but only if the output is set to hybrid. I changed to server and now and everything is nice and shiny again. A side-effect of this on Vercel is a very nasty 405 Method not allowed error that is basically undebuggable as there isn't a request shown in the logs even. Can be reproduced using curl; so it's independent of the client and it's params. Of course I did call an existing HTTP method - well, with an endpoint that would return a 404 of course ;) All this was "fixed" immediately after switching from hybrid to server.

If I had more time, I'd provide a minimal reproduction example. Maybe I can manage to do this in the next week(s). The issue is definitely still affecting code in the wild.