Server: timeoutMiddleware registered after catch-all route — never applies to SPA/404 handlers #65

New Issue

Closed

opened 2026-05-17 17:53:21 -05:00 by null · 0 comments

null commented

2026-05-17 17:53:21 -05:00

Owner

Bug Description

In server/index.js, the timeoutMiddleware is registered with app.use(timeoutMiddleware) after the catch-all app.get('*', ...) SPA handler (line ~285) and the app.use('/api', ...) 404 handler (line ~276).

Because Express processes middleware and routes in registration order, the catch-all app.get('*') handler matches GET requests before timeoutMiddleware is reached. This means:

SPA routes have no request timeout protection
The 404 API catch-all also runs without timeout protection

Fix

Move app.use(timeoutMiddleware) to BEFORE the API route definitions (or at least before the catch-all routes). The middleware should be registered early in the middleware chain, after body parsing and rate limiting but before route handlers.

Current order (broken):

Routes (including catch-all app.get('*'))
app.use(timeoutMiddleware) ← too late

Desired order:

Body parsing, rate limiting, etc.
app.use(timeoutMiddleware) ← early enough
Route handlers
Catch-all handlers

Labels

bug, backend, P2 Medium

## Bug Description In `server/index.js`, the `timeoutMiddleware` is registered with `app.use(timeoutMiddleware)` **after** the catch-all `app.get('*', ...)` SPA handler (line ~285) and the `app.use('/api', ...)` 404 handler (line ~276). Because Express processes middleware and routes in registration order, the catch-all `app.get('*')` handler matches GET requests before `timeoutMiddleware` is reached. This means: - SPA routes have no request timeout protection - The 404 API catch-all also runs without timeout protection ## Fix Move `app.use(timeoutMiddleware)` to BEFORE the API route definitions (or at least before the catch-all routes). The middleware should be registered early in the middleware chain, after body parsing and rate limiting but before route handlers. Current order (broken): 1. Routes (including catch-all `app.get('*')`) 2. `app.use(timeoutMiddleware)` ← too late Desired order: 1. Body parsing, rate limiting, etc. 2. `app.use(timeoutMiddleware)` ← early enough 3. Route handlers 4. Catch-all handlers ## Labels - bug, backend, P2 Medium