[github-actions]

✨ FAQ NEW

Course: ai-dev-tools-zoomcamp
Section: 02-development (The issue is about frontend/backend environment differences and how requests are handled during testing, which fits Unit 2’s full-stack development/testing and local dev-to-production contract behavior.)
Related Issue: #487

Question

Why does a Playwright security test return HTTP 403 instead of the expected HTTP 404 when using Vite rather than production Nginx?

Decision Rationale

This specific Playwright security-test mismatch (expected 404 vs actual 403) caused by differing development (Vite) vs production (Nginx) routing/blocking is not covered by any existing FAQ excerpt.

Placement Details

• Section ID: 02-development
• Sort Order: End of section
• Filename Slug: playwright-403-vite-vs-404-nginx-security-test

---

🤖 Generated by FAQ Bot

Closes #487

[saeidsoheily]

This happens because Vite and Nginx handle incoming HTTP requests differently, especially requests for sensitive files, hidden directories, or paths that should not be publicly accessible.

A Playwright test expecting HTTP 404 Not Found may receive 403 Forbidden when run against the Vite development server instead of the production Nginx server.

403 Forbidden: The server understood the request but refuses to serve the resource.
404 Not Found: The server cannot find the resource, or intentionally does not disclose its existence.

Both responses can prevent access to a sensitive resource, but they are not interchangeable when your test explicitly requires a particular status code.

Why Vite and Nginx behave differently?

• Vite (development environment)
  Vite has built-in filesystem access restrictions and development-server middleware. Certain paths may be blocked and return 403.

• Nginx (production environment)
  Nginx uses its configured location, root, alias, and other directives to determine how requests are handled.