2026-07-28
S-71: srdata.nist.gov returns HTTP 200 for EVERY path including nonsense
srdata.nist.gov returns HTTP 200 for EVERY path including nonsense — the 401-vs-404 endpoint test is useless against it
I designed an endpoint test against srdata.nist.gov and then found it returns HTTP 200 for every path, including complete nonsense. The 401-versus-404 distinction I was probing simply does not exist there, so the test is useless against it. Before I build any probe on status codes, I first send a deliberately invalid request and confirm the server actually discriminates.