Error pages return HTTP 200 instead of correct status codes (403, 404, 500)

[kerojohan]

Describe the bug

In DSpace, pages that should return proper HTTP error codes (e.g., 500, 404, or 403) are instead returning a 200 OK status. This misbehavior affects search engine indexing and SEO, as search engines may incorrectly interpret error pages as valid content.

I’ve tested this issue on the DSpace demo site using Firefox and Chrome, and the following URLs all return a 200 OK status instead of the appropriate error code:

• https://demo.dspace.org/500
• https://demo.dspace.org/404
• https://demo.dspace.org/403

This issue has been observed in both DSpace 7.x and DSpace 8.x.

To Reproduce

Steps to reproduce the behavior:

1. Open a browser (Chrome, Firefox)
2. Navigate to one of the following URLs:
   • https://demo.dspace.org/500
   • https://demo.dspace.org/404
   • https://demo.dspace.org/403
3. Inspect the HTTP response headers (e.g., using browser developer tools or curl -I)
4. Notice that the status code is 200 OK, even though the page clearly shows an error message

Expected behavior

The HTTP response should return the correct error status code:

• 404 Not Found for missing pages
• 403 Forbidden for unauthorized access
• 500 Internal Server Error for internal failures

This ensures correct behavior for clients and search engines, and improves SEO by preventing incorrect indexing of error pages.

Related work

N/A – please let me know if there's an existing issue or PR related to this.

[alanorth]

Hi @kerojohan. HTTP 404 errors for missing identifiers should be working correctly as of #2816. I don't know about the other errors, and I'm not sure if navigating directly to the error page is a good test?

[kerojohan]

Hi @alanorth,

Looking at the issue you referenced, it might actually be related to the same problem I'm experiencing. Direct access to those pages, or any non-existent path, should return a 404,403 or 500 status code.

I was testing with this URL: https://demo.dspace.org/test — since the page doesn't exist, I expected to receive a 404, but instead I got a 200 status.

Best regards,
Joan

[alanorth]

I was testing with this URL: demo.dspace.org/test — since the page doesn't exist, I expected to receive a 404, but instead I got a 200 status.

Yes, this may be. #2816 seems to only have fixed 404 responses for missing DSpace objects.