Don't return server-oriented, implementation-leaking error messages for client errors

Product

Hot Chocolate

Is your feature request related to a problem?

Consider for example this error:

https://github.com/ChilliCream/graphql-platform/blob/7d21adab765fffad291f22255db1102fed39234e/src/HotChocolate/Core/src/Execution/Properties/Resources.resx#L202

Any client can trivially produce this error by e.g. supplying an invalid value for a GUID field, which results in this message:

"Unable to convert the value of the argument id to System.Guid. Check if the requested type is correct or register a custom type converter."

There are two problems with this:

• The message, with its mention of registering custom type converters, is oriented toward the server's developers, not clients
• The message, in printing the fully qualified type name, leaks implementation details. With custom types here, an attacker could get some information about the structure of the codebase, possibly making inferences allowing them to more effectively hack the system.

The solution you'd like

Messages that are oriented toward API clients and which do not leak implementation details.

Start with the conversion error resource linked in src/HotChocolate/Core/src/Execution/Properties/Resources.resx, around line 202, and trace where it is used for invalid GUID arguments. Review the related client-visible error handling and define the wording so it is client-oriented without exposing fully qualified implementation types or server customization guidance.