asp.net - WebApi in OWIN always returning 200 instead of 404 when not matching a route -

i have relatively simple webapi site couple of controllers, running in owin autofac di container.

the site setup using attribute routes returns 200 ok response if hit invalid route. had filters , static file server running i've commented out of code within our startup file (all iappbuilder calls , creation of httpconfiguration) still behaviour. happens in both iis , iis express.

i've tried adding default route in have seen same behaviour.

i've done reading , understand can write kind of hook pipeline or write controller catch route , action returns 404, feels though shouldn't necessary.

is intended default behaviour?

i've looked @ answer don't have global.asax: asp.net web api returns 200 ok when should return 404

see reduced code below still demonstrates issue

startup.cs

[assembly: owinstartup(typeof(startup))] namespace api.blah {     using owin;      public class startup     {         public void configuration(iappbuilder app)         {             var config = new httpconfiguration();              var container = this.getautofaccontainer(config);             config.dependencyresolver = new autofacwebapidependencyresolver(container);              config.maphttpattributeroutes();              app.usewebapi(config);         }          private icontainer getautofaccontainer(httpconfiguration config)         {             containerbuilder containerbuilder = new containerbuilder();              containerbuilder.registerapicontrollers(assembly.getexecutingassembly());              return containerbuilder.build();         }     }  } 

healthcontroller.cs

namespace api.blah.controller {     [routeprefix("api/health")]         public class healthcontroller : apicontroller     {         public healthcontroller()         {          }          [httpget]         [route]         public healthresponse get()         {             return new healthresponse { alive = true, healthy = true };         }     } } 

if access other api/health route (eg http://localhost:1333/zz) 200. original code larger this, i've reduced explained above , same behaviour persists

this issue can happen if web.config contains staticfilemodule

<handlers>     <!-- remove handlers -->     <clear />     <add name="extensionlessurlhandler-integrated-4.0" path="*." verb="*" type="system.web.handlers.transferrequesthandler" precondition="integratedmode,runtimeversionv4.0" />     <add name="staticfile" path="*" verb="*" modules="staticfilemodule" resourcetype="unspecified" requireaccess="read" /> </handlers> 

if need static files, can work around using path:

<add name="staticfile" path="/staticfiles" verb="*" modules="staticfilemodule" resourcetype="unspecified" requireaccess="read" />