🐛 [Bug]: Slugs that start with `.` are stripped away

[gbyesiltas]

Package

storyblok-js-client (Client SDK)

Bug Description

When I make a request to a space with a slug such as: cdn/stories/pages/.something, the resulting network request goes to cdn/stories/pages/.

Steps to Reproduce

1. Initialise the StoryblokClient from storyblok-js-client with your access token
2. Find a folder you have content with a "home story" (e.g. cdn/stories/pages/)
3. Make a request to that folder with cdn/stories/pages/.anything
4. You will receive the content to the "home story"

Expected Behavior

I would expect to get either a 404 Not found or a 400 Bad request

Actual Behavior

It seems like the part of the slug with . gets stripped away

Code Sample

import StoryblokClient from "storyblok-js-client";

const myClient = new StoryblokClient({
  accessToken: "ACCESS_TOKEN",
});

const story = await myClient.get("cdn/stories/pages/.anything");

console.log(story);

Environment

System:
    OS: macOS 15.7.2
    CPU: (10) arm64 Apple M1 Max
    Memory: 683.41 MB / 32.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 25.2.1 - /Users/gbyesiltas/.n/bin/node
    Yarn: 1.22.22 - /Users/gbyesiltas/.n/bin/yarn
    npm: 11.6.2 - /Users/gbyesiltas/.n/bin/npm
    pnpm: 10.23.0 - /Users/gbyesiltas/.n/bin/pnpm
    bun: 1.2.2 - /Users/gbyesiltas/.bun/bin/bun
    Watchman: 2025.04.28.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 142.0.7444.176
    Firefox: 142.0.1
    Safari: 26.1
    Safari Technology Preview: 26.0
  npmPackages:
    @storyblok/nuxt: 8.2.1 => 8.2.1 
    @storyblok/richtext: 3.8.2 => 3.8.2 
    nuxt: 4.1.3 => 4.1.3 
    vue: 3.5.22 => 3.5.22

Additional Context

We have a nuxt project with a catch-all route, and we see some crawlers trying to randomly access paths like /.DS_Store or /.env and it seems to go to the homepage. While it's not actively breaking much, it does actually cause some errors to appear in our logs and also just feels like unexpected behaviour

[dipankarmaikap]

Hey @gbyesiltas

I tested this behaviour using the storyblok-js-client directly:

import StoryblokClient from "storyblok-js-client";
import { previewApiToken } from "./variables";

const client = new StoryblokClient({
  accessToken: previewApiToken,
  version: "draft",
});

const story = await client.get("cdn/stories/pages/home");
console.log(story.data?.story);

When the story doesn’t exist, the client correctly returns a 404 error, so the SDK itself seems to work as expected.

Since you mentioned you’re using Nuxt, it’s worth double-checking how your slug or fallback logic is handled. In a typical Nuxt setup, it looks something like this:

const { slug } = useRoute().params;
const url = slug && slug.length > 0 ? slug.join('/') : 'home';

await useStoryblokApi().get(`cdn/stories/${url}`);

If there’s any fallback to a default story or endpoint in your route/async data logic, that might be masking the 404 and returning an unexpected result.

Could you check if any fallback logic is being applied on your side?

If the issue persists, please share a minimal reproducible repo. That will help us debug it properly.

[gbyesiltas]

@dipankarmaikap

Hey! Thanks for the reply :)

I was actually able to reproduce this with just the js-client on a simple script without any of the nuxt context.

I see that in the example script that you tested, you are getting "/pages/home". The issue that I'm facing is that if I search for "/pages/.something-that-starts-with-dot", then I still do get the home story. And by the "home story", I mean the story that was defined as the root of the folder, sorry if I wasn't clear there.

// ✅ I get the root story
const story = await client.get("cdn/stories/pages/");

// ✅ I get the root story
const story = await client.get("cdn/stories/pages");

// ⚠️ I also get the root story
const story = await client.get("cdn/stories/pages/.env");

Otherwise I can provide a reproduction but really, it doesn't have anything more than the script I pasted in the initial comment.

[dipankarmaikap]

@gbyesiltas Thanks for the detailed reply. I was able to reproduce the issue as well. This only happens when a story is set as the root of a folder, and you try to fetch a route or slug with just a . in front of it. In that case, it ends up fetching the root page. This is indeed a bug.

However, it looks like the issue is on our API side, not the JS client. I tested directly and noticed the same behavior:

https://api.storyblok.com/v2/cdn/stories/pages/.home?version=draft&token=nVjy7VdMK6tt&cv=1764331643

This still works, which confirms the problem.

I’ll create an internal ticket for this and will ping you once it’s fixed. Thanks again for reporting it!

[gbyesiltas]

@dipankarmaikap thank you!