- Shipped
- September 8, 2026 at 1:47 AM UTC
- Author
- Kamo
- Commit
- 00f8143
Pressing Start game returned 1,529,239 bytes of markup. `/api/media/*` is not a proxied prefix — every path under it is a hand-written Next route and there is no catch-all — so `/api/media/chess/*` reached Next rather than MediaService, and Next answered with its own 404 page, RSC payload inlined. The client threw that body verbatim as the error. The whole feature was unreachable from the browser, and server-side checks said otherwise the entire time: MediaService's endpoints answered 401 correctly when probed by port-forward, because the request never got near them. Probing the owning service is not end-to-end; only the path the browser takes is. Confirmed by curling the kamo-internal pod, where /api/media/chess/games returned 404 with an HTML body while its neighbours returned 401 with 24 bytes. One catch-all rather than ten route files: chess has ten endpoints under a single prefix owned by one controller, and every method of that controller enforces PLAY_CHESS for itself, so the proxy cannot widen anything. Ten copies of the same forward would be ten places to forget the eleventh endpoint — which is this bug. The path is rebuilt from the segments Next parsed, each re-encoded, so a segment cannot climb out of the prefix. The second half is the client, and it would have made any future gateway error page just as unreadable: a response body is no longer trusted on its shape. Markup is discarded for a sentence saying what happened, a JSON envelope is unwrapped, and only a short plain answer is shown as-is — because the server's own words are the useful ones. Checked before length, since a short error page is still a page.