Search code examples
flaskhttp-status-code-404subdomainregistrar

Accessing wildcard page in flask by naked domain from phone redirects to searchvity.com

Hi I'm new at domains and registrars and just stumbled upon a really weird behaviour that I don't know how to tackle.

I built a website with flask (hosted in PythonAnywhere, with domain.com as my registrar). I set things up at domain.com so that the naked domain redirects to the www. version, and it works well for any page in the site that I've defined specifically in my flask like @app.route('/something/').

I had to tweak things a bit so that the naked domain also accepts them without the last slash, like this...

@app.route('/something/')
@app.route('/something')
def something()
    # actual code

...but, when I try to access a page that doesn't exist through the naked domain, on computer it doesn't work (404 error, doesn't even show a simple html page) and on my phone it shows a weird random page that after gossiping a bit I realized is by searchvity.com. And I mean, I have absolutely no clue about how on earth that's possible.

Also, the weirdest part of all this is I actually have a route in flask that should manage this (@app.route('/<randomurl>/'), also with and without slash), but as said, that only works when accessing the www. version of the domain.

I know it's kinda a minor issue (since why would anyone try to access on purpose a page that doesn't exist specifically in the naked domain). But it bothers me quite a bit that someone could be redirected to that random site if the conditions are given and they are comming from phone... and in any case it's an issue that shouldn't be there and I don't even know where to start in order to fix it.

EDIT: now apparently the desktop version also shows that same weird page.

EDIT2: The reason I had only 404 on my desktop and not the weird (DNS spoofing?) page was AdBlock.

EDIT3: When the issue happens, the server at pythonanywhere doesn't even see the access data (it's like nothing happened).

Solution

  • Finally I found NakedSSL, which lets you redirect people from your naked domain towards the https version.

    I got to add a free SSL certificate on my pythonanywhere page (which is as easy as two clicks), and then on NakedSSL everything is quite straight forward too.

    Now I get the proper pages in all the cases (404, wildcard, etc) and there are no more weird spoofing things.