Issue Summary

When the user access a non existing URL in Jira, it will forward the user to a 404 error page.
As an example, accessing <Jira Base URL>/anything from the browser gives the user a page similar to the below.

It is expected that Jira will respond with a 404 error to any non existing page in the system.
However, if the user tries to access <Jira Base URL>/<anything>/secure/<valid servlet>, then the page will be rendered instead of sending a 404.

For example, in Jira Core the Manage Dashboards URL is <Jira Base URL>/secure/ConfigurePortalPages.jspa, which loads a page similar to the below.

If the user tries to access <Jira Base URL>/anything/secure/ConfigurePortalPages.jspa, then the page is rendered instead of sending a 404 error.

Depending on the page behind the <Jira Base URL>/secure/ URL, the page renders with almost no error.
On other cases, it may render a page with unexpected contents.

An example of the above occurs when accessing the Agile Board of a Jira Software project.
A valid URL would be <Jira Base URL>/secure/RapidBoard.jspa?rapidView=1&view=planning.nodetail&issueLimit=100, which would render a page similar to the below.

Accessing <Jira Base URL>/anything/secure/RapidBoard.jspa?rapidView=1&view=planning.nodetail&issueLimit=100 would send the user to a page similar to the below, instead of a 404 page.


In the above description we used <Jira Base URL>/anything/secure/... as an example, but the path /anything could be changed with any other string.
A valid use case for customers is when the Jira context path is removed, so users should access a different URL from what they are used to.
There may be cases when users keep bookmarks of the old URL with the context path.

Steps to Reproduce

1. Install a vanilla instance of Jira Core.
   • This was validated on versions 8.5, 8.13 and 8.15.0.
2. Access <Jira Base URL>/anything/secure/ConfigurePortalPages.jspa in the browser.

Expected Results

The 404 error page is shown to the user notifying this is not an existing page.

Actual Results

The request is accepted and Jira will load a page.

Workaround

Currently there is no known workaround for the general behavior. A workaround will be added here when available.

In the case of context path removed, administrators may choose to work with rewrite rules in the load balancer / reverse proxy.