From 88b8afb8d647821756f502977f157d65bf49d0d6 Mon Sep 17 00:00:00 2001
From: Jason Rasmussen <jason@rasm.me>
Date: Tue, 24 Jun 2025 11:37:14 -0400
Subject: [PATCH] fix: return 404 for invalid shared link pages (#19493)

---
 e2e/src/api/specs/shared-link.e2e-spec.ts | 10 +++++++
 server/src/services/api.service.ts        | 36 ++++++++---------------
 2 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/e2e/src/api/specs/shared-link.e2e-spec.ts b/e2e/src/api/specs/shared-link.e2e-spec.ts
index 04ed8ca0a4..97aa252dbb 100644
--- a/e2e/src/api/specs/shared-link.e2e-spec.ts
+++ b/e2e/src/api/specs/shared-link.e2e-spec.ts
@@ -119,6 +119,16 @@ describe('/shared-links', () => {
       expect(resp.header['content-type']).toContain('text/html');
       expect(resp.text).toContain(`<meta property="og:image" content="https://my.immich.app`);
     });
+
+    it('should return 404 for an invalid shared link', async () => {
+      const resp = await request(shareUrl).get(`/invalid-key`);
+      expect(resp.status).toBe(404);
+      expect(resp.header['content-type']).toContain('text/html');
+      expect(resp.text).not.toContain(`og:type`);
+      expect(resp.text).not.toContain(`og:title`);
+      expect(resp.text).not.toContain(`og:description`);
+      expect(resp.text).not.toContain(`og:image`);
+    });
   });
 
   describe('GET /shared-links', () => {
diff --git a/server/src/services/api.service.ts b/server/src/services/api.service.ts
index 6bfbf307f6..6b40aa46ef 100644
--- a/server/src/services/api.service.ts
+++ b/server/src/services/api.service.ts
@@ -78,36 +78,24 @@ export class ApiService {
         return next();
       }
 
-      const targets = [
-        {
-          regex: /^\/share\/(.+)$/,
-          onMatch: async (matches: RegExpMatchArray) => {
-            const key = matches[1];
-            const auth = await this.authService.validateSharedLink(key);
-            return this.sharedLinkService.getMetadataTags(auth);
-          },
-        },
-      ];
-
+      let status = 200;
       let html = index;
 
-      try {
-        for (const { regex, onMatch } of targets) {
-          const matches = request.url.match(regex);
-          if (matches) {
-            const meta = await onMatch(matches);
-            if (meta) {
-              html = render(index, meta);
-            }
-
-            break;
+      const shareMatches = request.url.match(/^\/share\/(.+)$/);
+      if (shareMatches) {
+        try {
+          const key = shareMatches[1];
+          const auth = await this.authService.validateSharedLink(key);
+          const meta = await this.sharedLinkService.getMetadataTags(auth);
+          if (meta) {
+            html = render(index, meta);
           }
+        } catch {
+          status = 404;
         }
-      } catch {
-        // nothing to do here
       }
 
-      res.type('text/html').header('Cache-Control', 'no-store').send(html);
+      res.status(status).type('text/html').header('Cache-Control', 'no-store').send(html);
     };
   }
 }