fix: exclude API paths from SPA catch-all route - #728
Closed
bbrands02 wants to merge 2 commits into
Closed
Conversation
The catch-all regex '.+' matched every GET path including /api/..., causing all API GET requests without a more specific route to be served by the Vue app controller and return HTML instead of JSON. Narrow the regex to '^(?!api(?:/|$)).+' so only non-API paths fall through to the SPA, while /api/* routes resolve to their resource controllers as intended. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…kage Symfony embeds parameter requirements verbatim inside named capture groups in the compiled route regex. A leading ^ inside a group asserts start-of- string, which is never true mid-URL, so the catch-all matched nothing and SPA deep links returned 404. The negative lookahead anchors implicitly at the start of the parameter value without needing ^. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rjzondervan
approved these changes
Apr 24, 2026
WilcoLouwerse
approved these changes
Apr 24, 2026
WilcoLouwerse
left a comment
WilcoLouwerse
left a comment
Contributor
There was a problem hiding this comment.
No blockers found. The negative lookahead correctly excludes all /api/... paths from the SPA catch-all while leaving all explicit frontend routes intact; CI failures appear pre-existing and unrelated to this routing-only change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Commit
45644173(2026-03-16, "feat: Enrich 3 specs, add prometheus metrics") introduced a SPA catch-all route/{path}with requirement.+for the first time. Before that, every frontend route was explicitly registered as aui#*route — there was no catch-all, and the API worked correctly. The catch-all was broken from the moment it was added:.+matches every GET path including/api/…, so any API GET request without a more specific route registered above it was handled by the Vue app controller and returned HTML instead of JSON.Changed the regex to
(?!api(?:/|$)).+so only non-API paths fall through to the SPA. Requests to/api/*now resolve to their resource controllers as intended.The leading
^was intentionally omitted from the requirement: Symfony embeds parameter requirements verbatim inside named capture groups in the compiled route regex, so a^inside the group would assert start-of-string from a mid-URL position and never match — disabling the catch-all entirely and causing SPA deep links to 404. The negative lookahead anchors implicitly at the start of the parameter value without it.Test plan
/api/…endpoint — verify JSON is returned, not HTML/sources/123) — verify the Vue app loads correctly🤖 Generated with Claude Code