Status 200 for 404 Not Found CMS page

Question

In short, Magento returns status 200 for the 404 Not Found CMS page, for what seems to be a pretty standard configuration:

Everything works fine when the URL is changed to cms/index/defaultNoRoute, the default Not Found page is loaded with status 404.

Also, absolutely everything works fine on a copy of the website on a different server. Which would lead me to suspect the Apache configuration. Not sure though what to look out for.

Here are response headers for both defaultNoRoute and noRoute actions:

$ curl -I http://www.server.com/cms/index/defaultNoRoute
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2013 12:56:07 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Set-Cookie: frontend=332f53c81eee1f730f430c0f59e0dd83; expires=Thu, 25-Apr-2013 13:56:08 GMT; path=/; domain=www.server.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Status: 404 File not found
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8

$ curl -I http://www.server.com/cms/index/noRoute
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2013 12:56:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Set-Cookie: frontend=361b3804feaea66a6fcdf1aee048ce44; expires=Thu, 25-Apr-2013 13:56:12 GMT; path=/; domain=www.server.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

Anyone can point me in the right direction? Cheers.

Answer 1

In my experience this is most often caused by poorly written CMS integrations. It's not uncommon for a CMS integration to rewrite the noRoute action to catch when Magento would issue a 404, grab content from a CMS (if available) and then serve it up in the content section of the page.

What goes wrong, however, is when these custom integrations then fail to detect when they also do not have content for the URL in the CMS and indiscriminately send out a 200 response code with either blank content or a 404 content page served from the CMS (but with a 200 response code).

In the case of no content, in this type of integration, the trick is to simply forward the request to the default no route action and/or fall through and let the parent controller method handle the 404 response.

Do you have a CMS integration module of some sort installed? If so, I would suggest isolating it to either prove or rule it out as the cause.