In Vite SSR Boost, a default GET request for /.env or /random.php is rejected with a plain 404 before the React render pipeline runs. That behavior comes from the package’s request guard; it is not a guarantee for every React server or every request reaching your infrastructure. The key distinction is between a suspicious target, which the guard rejects, and an ordinary missing page, which may still be rendered by the router.
What the Vite SSR Boost request guard does
Vite SSR Boost provides server-side rendering for React Router apps in Vite. Its README describes a default-on guard that checks document methods and targets before hooks. Melissa Ashford’s Sep 22, 2026 article gives the more detailed behavior; it does not identify an exact package release number, so confirm the options against the version installed in your app. The project README is on a mutable branch and may change.
Under the described defaults, GET requests for /.env, /random.php, and unmatched /missing.xml receive a plain 404 rather than invoking React rendering. A matching resource route such as /sitemap.xml can pass the target check. The guard’s method and target checks are separate: a method may be allowed while its target is rejected.
Methods are checked before document hooks
The default allowed document methods are GET, HEAD, and POST. Other methods receive 405 with an Allow header before onRequest, HTML loading, or route loaders. If a CORS preflight needs to reach a hook, add OPTIONS to requestGuard.methods. The configured array replaces the defaults, so include any default methods your app still needs.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Targets can be rejected even for an allowed method
For allowed methods, the guard can return 414 for an oversized target and 400 for a malformed path. The suspicious examples above receive a plain 404. This is document-handler behavior, not proof that all traffic to your server, static-file middleware, APIs, or upstream infrastructure is protected. Setting requestGuard: false disables this guard and the missing-page behavior described with it.
Why a missing route is not the same as a suspicious path
A normal unmatched document such as /missing follows the router’s missing-page policy; it does not automatically get the guard’s plain 404. In the described configuration, notFound defaults to render: the normal router/render path runs. That is useful when app-level handling should produce the page, but it does more work than an early plain 404.
Rank #2
- Book - 1, 000 books to read before you die: a life-changing list (1000 before you die)
- Language: english
- Binding: hardcover
The four approaches below are distinct. The detailed behaviors are those described for Vite SSR Boost, not universal React SSR rules.
| Approach | Status and React pipeline | Hooks/loaders | Bot handling | Reuse and privacy |
|---|---|---|---|---|
| Default unmatched-route render | Normal router/render path; status follows the app’s route behavior. | Runs as part of the normal request path. | Uses the render path. | Not described as shared cached output. |
notFound: 'spa' |
Serves a client shell with status 404 rather than doing the normal server render. | Does not use the normal render path; exact hook behavior is not stated in the article. | Detected bots still use the render path under the described default bot policy. | Not described as shared cached output. |
Custom Response |
Can return a static 404 without the render pipeline. | Bypasses the render pipeline; hook details depend on where the response is returned. | Bot-specific treatment is not stated. | Output is application-defined; inspect your document header rules. |
notFound: 'cached' |
Buffers a router 404 and reuses it while retained. | Cache hits skip onRequest, loaders, and admission. |
Bot-specific treatment is not stated. | Can reuse output across missing paths; keep private/session state out of shared HTML. |
A catch-all route changes the decision because it counts as a match. If that route should use a missing-page mode, configure requestGuard.decide to return 'notFound' for the relevant request. Otherwise, the matched route may proceed as an ordinary match.
Choose a 404 mode with cache and session behavior in mind
Use normal rendering when the response depends on the visitor
Ordinary rendering keeps missing-page output in the app’s normal route flow. It is the safer fit when the page depends on a session, user identity, or other per-request state, because it avoids deliberately sharing a buffered 404 across paths.
Use the SPA shell for a client-handled 404
The spa mode returns a client shell with HTTP 404. Under the described default bot policy, detected bots still take the render path. This missing-page SPA mode is not the same as admission overload configured with overload: 'spa': the latter returns a 200 shell to humans when capacity is full, while detected bots receive 503.
Use a custom response for a deliberately static 404
A custom Response lets the app send a static 404 without running the render pipeline. Ensure the response has the intended headers; document header rules may override the stated default private, no-store behavior.
Treat cached 404s as shared output
The cached mode buffers a router 404 and reuses it while retained. Concurrent misses for the same cache key share a render; hits skip onRequest, loaders, and admission. By default, the key is shared across missing paths and includes the first rendered URL and hydration data. A cold render uses GET without the original request body, and Cookie and Authorization are removed before the request hook. Other headers, the URL, and application state can still influence the response.
Recommended Free Tools
- Keep private or session-specific information out of cached HTML.
- Choose a key that separates public variants such as locale when their output differs.
- Avoid cached mode for session-dependent pages.
- A configured CSP nonce disables the cache; failed renders and non-404 results are not retained.
- Review document header rules, because they can override the stated default
private, no-storeheader.
Admission limits protect a different part of the request
Request validation and SSR admission are separate controls. Admission is off by default in the described account. It can be enabled with a positive safe integer in admission.maxConcurrency or a valid SSR_MAX_CONCURRENCY; the environment value wins and is read when the handler or entry is created. The limit is local to a handler, not cluster-wide.
When capacity is reached, the described default response is 503 with Retry-After and private, no-store; there is no queue. Admission happens after request initialization and the SSR/SPA decision. As a result, onRequest and HTML loading have already happened before a request is rejected for capacity. For normal streamed responses, the slot remains occupied until the Fetch response stream is consumed.
With admission.overload: 'spa', humans receive a 200 client shell while detected bots receive 503. That policy concerns overload, not a missing route.
Checks to make in your application
- If preflight requests need application handling, confirm that OPTIONS is included in
requestGuard.methodsalong with the methods you still require. - Try a suspicious target such as
/.envand an ordinary missing document such as/missing; verify that the former is rejected and that the latter follows your selected 404 mode. - If using cached 404s, request different missing paths and locales, then confirm that no session-specific content is reused and that the cache key separates public variants as intended.
- Inspect the final response headers to ensure document header rules do not remove the intended private/no-store policy.
- To check admission, hold one normal streamed SSR response open and send another SSR request at the configured capacity. Account for the fact that initialization and HTML loading occur before the second request is rejected.
The behavior described here is a request-routing and rendering safeguard. It does not, by itself, establish that credentials were exposed or that every endpoint is protected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
