From b1c412f3d7e089ce5cf987fa7a4a3e0b606bdb2f Mon Sep 17 00:00:00 2001 From: Finn Stutzenstein Date: Thu, 22 Oct 2026 18:37:12 +0000 Subject: [PATCH] Show the not found page for unknown URLs A catch-all rule raises NotFound, so unknown URLs pass the middlewares and get the regular not found page instead of Flask's default 404. Anonymous visitors are redirected to the login like for any other URL, so they cannot tell which URLs exist. Co-Authored-By: Claude Opus 5.5 --- max/routes/__init__.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/max/routes/__init__.py b/max/routes/__init__.py index c241002..277819c 100644 --- a/max/routes/__init__.py +++ b/max/routes/__init__.py @@ -1,5 +1,6 @@ from max.auth import no_authentication_required from max.csrf import no_csrf +from max.exceptions import NotFound from .alias.create import AliasCreate from .alias.delete import AliasDelete @@ -21,6 +22,10 @@ from .user.toggle_can_use_different_alias_domain import ( from .user.toggle_enabled import UserToggleEnabled +def not_found(**kwargs): + raise NotFound() + + def init_routes(app): app.add_url_rule("/", "own-user-detail", UserDetail.as_view()) app.add_url_rule("/list", "user-list", UserList.as_view()) @@ -78,3 +83,7 @@ def init_routes(app): "favicon", no_csrf(no_authentication_required(Favicon.as_view())), ) + + # Matches only URLs without another rule. They pass the middlewares like any + # other view, so the ExceptionMiddleware renders the not found page. + app.add_url_rule("/", "not-found", not_found)