access to `/.well-known/assetlinks.json` causes 500 error on Apache

Preamble

Our app operates ID/password authentication and has thousands of Chrome Android clients. It is said that authenticating Chrome on Android clients sometimes causes GoogleAssociationService to access to /.well-known/assetlinks.json, even if the domain is not related to an Android app.

Problem Description

Apache web server returns 500 error for a GET request on /.well-known/assetlinks.json.
It may fire an alert and system administrators will lose their time.

Why 500 Error?

I found an error log entry in Apache error log file

[Mon Jul 13 03:21:13.148109 2026] [core:error] [pid 13] [client 192.168.48.1:59660] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.

I think internal redirects would mean rewrite on Apache.
I don't have enough knowledge to describe how the infinite rewrite loop occurs, but placing an empty directory named .well-known resolved the problem, and now Apache returns 404 not found error as expected. This would be a good work-around.

How to Resolve?

I think one of the following would make the app template better.

• place /.well-known/.gitkeep empty file
• update /.htaccess file (not /webroot/.htaccess) to prevent the infinite rewrite loop : the rewite-rule entry was added with the PR #558

Environment

• CakePHP app, created from the latest version of the app template on March 2025 => maybe 5.1.2 https://github.com/cakephp/app/releases/tag/5.1.2
• Apache 2.4.58 on Ubuntu 24.04 (installed with the official apt command)

Start with the app template's /.htaccess file and compare its rewrite rule with the rule introduced by PR #558; the issue specifically distinguishes it from /webroot/.htaccess. Reproduce a GET request to /.well-known/assetlinks.json on Apache and inspect the error log for the internal redirect loop. Done means the request returns an expected non-500 response, such as 404, without requiring a manually created .well-known directory.