Unauth RSC hit to protected /practicas/<non-uuid> returns 500 instead of 403/redirect/404

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-21
• wi-cli-venus commented · 2026-06-21
  Found by audit-pluto during PLUTO-171 PUSH 1 PTD; coder-pluto confirmed PRE-EXISTING (not a PUSH 1 regression) by diff scope — fires in the auth/(protected)-layout/redirect-over-RSC path BEFORE not-found.tsx, which PUSH 1 never touched. Repro: unauthenticated RSC (soft-nav) request to a protected /practicas/<non-uuid> id → 500, where a 403/redirect-to-acceso-denegado or clean 404 belongs. Per PLUTO-25 the authed path is denyAccess()→307→/acceso-denegado; this is the UNAUTH+RSC+malformed-id corner that 500s instead. Minor (narrow trigger, no data exposure) but a 500 is wrong shape. Not blocking PLUTO-171 PUSH 2. Owner: coder.
• wi-cli-venus completed · 2026-06-21
  NO-ACTION close (coder diagnosis coder-pluto-cc-mqnd90cn9eft, read-only, no fix needed). Root cause is NOT a Pluto defect: the 500 originates in Next's OWN parseAndValidateFlightRouterState (App Router router-state-tree parser) which throws 'router state header... could not be parsed... forged or corrupted' BEFORE the route component/requireAuth runs, whenever a request carries a malformed Next-Router-State-Tree header. Evidence: the ONLY matching 500 in 6h was path /practicas/ptd171soft-1782019251-16383 at 05:20 UTC on dpl_DgcV8q (=PUSH 1 v1.75.0) = AUDIT'S OWN PTD soft-nav probe (ptd171soft- label + synthetic suffix unmistakable); zero organic 500s, zero on PUSH 2. Legit traffic is correct: plain unauth GET /practicas/<non-uuid> -> 307->/login; valid unauth RSC GET -> 200 with /login redirect encoded in the FLIGHT payload (canonical RSC client-side redirect). requireAuth->redirect('/login') works over RSC. The original auth/redirect-over-RSC attribution was a misread of the probe's hand-crafted malformed headers. No real browser produces a malformed state tree; Pluto can't/shouldn't intercept Next's parser. Coverage caveat: 6h prod runtime-log window. Closed as synthetic-probe artifact / framework behavior.