JCU/fix(ssr): return HTTP 404 for non-existent routes behind the dev-6.pc proxy

config/config.example.yml

@@ -44,6 +44,15 @@ ssr:
     - pattern: "^/access-control/"
     - pattern: "^/health$"
 
+  # Extra hostnames allowed to be server-side rendered, on top of the hostname of ui.baseUrl
+  # (which is always allowed). Angular's SSR only renders when the request "Host" header matches
+  # an allowed host; any other host silently falls back to CSR (which always answers 200, so a
+  # "not found" page can never return a 404). When the app is served behind a reverse proxy on a
+  # hostname different from ui.baseUrl, list that hostname here. Compared by hostname only (the
+  # port is ignored). Defaults to none.
+  # allowedHosts:
+  #   - my-repository.example.com
+
   # Whether to enable rendering of Search component on SSR.
   # If set to true the component will be included in the HTML returned from the server side rendering.
   # If set to false the component will not be included in the HTML returned from the server side rendering.

config/config.yml

@@ -51,6 +51,13 @@ themes:
           href: assets/custom/images/favicons/manifest.webmanifest
 
 ssr:
+  # Hosts allowed to be server-side rendered in addition to ui.baseUrl's hostname (always allowed).
+  # The JCU test instance is served behind nginx on dev-6.pc while ui.baseUrl stays http://localhost:4000,
+  # so without dev-6.pc listed here SSR falls back to CSR for that host and "not found" pages answer 200
+  # instead of 404. Compared by hostname only (port ignored). Harmless in production, where the public
+  # hostname already matches ui.baseUrl.
+  allowedHosts:
+    - dev-6.pc
   excludePathPatterns:
     - pattern: "^/communities/[a-f0-9-]{36}/browse(/.*)?$"
       flag: "i"

server.ts

@@ -247,9 +247,16 @@ function ngApp(req, res, next) {
 function serverSideRender(req, res, next, sendToUser: boolean = true) {
   const { protocol, originalUrl, baseUrl, headers } = req;
   // "allowedHosts" specifies which hosts are allowed to be rendered via SSR.
-  // By default, this is set to the host of the UI's baseUrl.
+  // The host of the UI's baseUrl is always allowed; any extra hosts configured via
+  // ssr.allowedHosts are added so SSR keeps working when the app is reached through a
+  // reverse proxy on a hostname that differs from baseUrl (otherwise those requests
+  // silently fall back to CSR, which always answers 200 and can never return a 404).
+  const allowedHosts = [ ...new Set([
+    new URL(environment.ui.baseUrl).hostname,
+    ...(environment.ssr.allowedHosts ?? []),
+  ]) ];
   const commonEngine = new CommonEngine({ enablePerformanceProfiler: environment.ssr.enablePerformanceProfiler,
-                                          allowedHosts: [ new URL(environment.ui.baseUrl).hostname ],
+                                          allowedHosts,
                                         });
   // Render the page via SSR (server side rendering)
   commonEngine

src/config/ssr-config.interface.ts

@@ -48,6 +48,18 @@ export interface SSRConfig extends Config {
    */
   excludePathPatterns:  SsrExcludePatterns[];
 
+  /**
+   * Extra hostnames that are allowed to be server-side rendered, in addition to the hostname of
+   * {@link UIServerConfig#baseUrl} (which is always allowed).
+   *
+   * Angular's SSR engine only renders a request when its `Host` header matches one of the allowed
+   * hosts; any other host silently falls back to client-side rendering (which always answers 200,
+   * so "not found" pages can never return a 404). When the app is reached through a reverse proxy
+   * on a hostname that differs from `ui.baseUrl` (e.g. a shared test box), list that hostname here
+   * so SSR keeps working. Compared by hostname only, the port is ignored. Defaults to none.
+   */
+  allowedHosts?: string[];
+
   /**
    * Whether to enable rendering of search component on SSR
    */