Lighttpd

Also I would like to see possibility to change that in lua (have searched but haven't found it).
So when stat fails in lua it could be set to 404 when making a redirect there.

attr = lighty.stat(lighty.env['physical.path'])
if (not attr) then
        -- file still missing. pass it to the fastcgi backend
        lighty.env["uri.path"]          = "/index.php" 
        lighty.env["physical.rel-path"] = lighty.env["uri.path"]
        lighty.env["request.orig-uri"]  = lighty.env["request.uri"]
        lighty.env["physical.path"]     = lighty.env["physical.doc-root"] .. lighty.env["physical.rel-path"]
        -- like this or something:
        lighty.env["request.status"]    = 404
end

With PHP you can work around this bug by putting this at the top of your script:

<?php header(‘HTTP/1.0 404 Not found’); ?>

EDIT: I read the FrequentlyAskedQuestions; now I have an answer for those who are not using PHP. For custom error messages, one should use "server.errorfile-prefix" instead, and have files named "404.html", "403.html", "500.html" etc in that directory.

I was confused by the name "server.error-handler-404" since I thought it was for reporting 404 errors, but the FAQ tells me it's actually for creating new pages to replace 404 errors.

Unfortunately your solution doesn't address the problem. Your code returns a HTTP 404 error to the browser, but the bug is about detecting the error code that caused your script to be called in the first place.

For example if you have server.error-handler-404="index.php" and then you visit http://yoursite/index.php followed by http://yoursite/badpage both times index.php will be called, but $_SERVER['REDIRECT_STATUS'] will be 200 both times, so you don't know whether you're being called directly or as the result of a 404 redirect.

Under Apache, the second URL will set $_SERVER['REDIRECT_STATUS'] to 404 so you know the script is being called as the result of a 404 redirect.

Some content management systems use this for 'friendly URLs', so these systems cannot run correctly under lighttpd.

Submitted https://github.com/lighttpd/lighttpd1.4/pull/35 to set REDIRECT_STATUS to HTTP status code for access by server.error-handler-404. Currently, the only values will be 403 or 404, as those are the HTTP status codes intercepted by server.error-handler-404.