ai_ml_operations/server-infra
2
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Serve Hesychia pages with 404s and security headers #45

Merged
westfarn merged 1 commits from feat/124-hesychia-public-pages into feat/43-static-crawler-files 2026-10-19 08:02:52 -07:00
Conversation 0 Commits 1 Files Changed 2
+43
westfarn commented 2026-10-19 07:57:24 -07:00
Owner
Copy link
Copy source

Summary

  • Unknown Hesychia URLs return 404 with 404.html instead of 200 and the app shell.
  • Extensionless routes (/legal/terms-of-service, billing return paths, /document_storage) are served as HTML.
  • chat_web_app sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only.
  • Production only: one-character paths redirect for HeyCatch short links.

Depends on #44. Merge that first, then retarget this to master if Gitea does not do it automatically.

Test plan

  • After #44 and this change are deployed, curl -sI https://hesychia.ai/not-a-page is 404.
  • curl -sI https://hesychia.ai/pricing/ is 200 once the frontend shells are published.
  • Response headers include Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy.
  • curl -sI https://hesychia.ai/x is a 302 to /?utm_source=heycatch&utm_campaign=x.
## Summary - Unknown Hesychia URLs return 404 with `404.html` instead of 200 and the app shell. - Extensionless routes (`/legal/terms-of-service`, billing return paths, `/document_storage`) are served as HTML. - `chat_web_app` sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only. - Production only: one-character paths redirect for HeyCatch short links. Depends on #44. Merge that first, then retarget this to `master` if Gitea does not do it automatically. ## Test plan - [ ] After #44 and this change are deployed, `curl -sI https://hesychia.ai/not-a-page` is 404. - [ ] `curl -sI https://hesychia.ai/pricing/` is 200 once the frontend shells are published. - [ ] Response headers include `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy`. - [ ] `curl -sI https://hesychia.ai/x` is a 302 to `/?utm_source=heycatch&utm_campaign=x`.
westfarn added 1 commit 2026-10-19 07:57:24 -07:00
Serve Hesychia public routes as real files with security headers. d0c8b3f419 
Unknown URLs were returning the app shell with status 200. Return 404 for missing paths, keep the extensionless pages, and send the security headers. Production short links redirect for HeyCatch.

Co-authored-by: Cursor <cursoragent@cursor.com>
westfarn merged commit 5e9878632e into feat/43-static-crawler-files 2026-10-19 08:02:52 -07:00
westfarn deleted branch feat/124-hesychia-public-pages 2026-10-19 08:02:52 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/server-infra#45