I believe this is already taken care of in the VuFind 2.0 code, but if you want to submit a patch for 1.x when you fix it, I'll be happy to incorporate that into the trunk for the 1.4 release. Thanks for pointing this out!
From: Bernhardt, Russell (CIV) [rgbernha@...]
Sent: Thursday, March 15, 2012 4:17 PM
Subject: [VuFind-General] Vufind doesn't return 404 status for non-existing records/urls
We recently had a similar problem with DSpace, where “not found” errors would return the custom error page, but would return “200 OK” in the status header (I believe they changed this for the recently released 1.8). This causes problems with our internal information assurance scan tools as they flag fake urls (like /cart/login) that don’t return 404 and thus count them as existing.
While it doesn’t seem necessary from a user standpoint, it would make web logs and security audits much more accurate. I can change this in my own instance of VuFind, but I wonder if it should be considered for the next iteration if other people are having similar problems…
Just some food for thought.
I was able to force my error pages to return 404 by adding header(‘HTTP/1.0 404 Not found’); to index.php, just below the $interface->display(‘error.tpl’); line.
Library Information Systems
Dudley Knox Library
Naval Postgraduate School, Monterey CA