From 6a911e4ec3572faa954424e4ca96eb9da5c0914f Mon Sep 17 00:00:00 2001
From: Jakob Ackermann <jakob.ackermann@overleaf.com>
Date: Mon, 11 May 2026 14:10:17 +0200
Subject: [PATCH] [web] do not send a second response from api error handler
 (#33526)

GitOrigin-RevId: 6974f5d5f7042d5170eb2a755715b2d139f06130
---
 .../web/app/src/Features/Errors/ErrorController.mjs | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/services/web/app/src/Features/Errors/ErrorController.mjs b/services/web/app/src/Features/Errors/ErrorController.mjs
index 37316304a8..810c44ef1c 100644
--- a/services/web/app/src/Features/Errors/ErrorController.mjs
+++ b/services/web/app/src/Features/Errors/ErrorController.mjs
@@ -128,31 +128,32 @@ async function handleError(error, req, res, next) {
 }
 
 function handleApiError(err, req, res, next) {
+  const shouldSendErrorResponse = !res.headersSent
   req.logger.addFields({ err })
   if (
     err instanceof Errors.NotFoundError ||
     err instanceof InvalidParamsError
   ) {
     req.logger.setLevel('warn')
-    res.sendStatus(404)
+    if (shouldSendErrorResponse) res.sendStatus(404)
   } else if (
     err instanceof URIError &&
     err.message.match(/^Failed to decode param/)
   ) {
     req.logger.setLevel('warn')
-    res.sendStatus(400)
+    if (shouldSendErrorResponse) res.sendStatus(400)
   } else if (err instanceof Errors.TooManyRequestsError) {
     req.logger.setLevel('warn')
-    res.sendStatus(429)
+    if (shouldSendErrorResponse) res.sendStatus(429)
   } else if (err instanceof Errors.ForbiddenError) {
     req.logger.setLevel('warn')
-    res.sendStatus(403)
+    if (shouldSendErrorResponse) res.sendStatus(403)
   } else if (err instanceof InvalidRequestError) {
     req.logger.setLevel('warn')
-    res.sendStatus(400)
+    if (shouldSendErrorResponse) res.sendStatus(400)
   } else {
     req.logger.setLevel('error')
-    res.sendStatus(500)
+    if (shouldSendErrorResponse) res.sendStatus(500)
   }
 }