OWASP / OWASP/Nest

Rework backend/frontend exception handling for data validation errors

Open
#3,529 3 comments 0 reactions 0 assignees View on GitHub
bug enhancement
Dominant language
Python
Stars
451
Forks
702
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Is your feature request related to a problem? Please describe.**
Currently, data validation errors are handled inconsistently across the backend and frontend.
- Backend uses different exception patterns (`ValidationError`, `PermissionDenied`, `ObjectDoesNotExist`) across GraphQL and REST APIs.
- GraphQL mutations raise `ValidationError` directly, while REST APIs use a custom exception handler, resulting in inconsistent error formats.
- Frontend error handling treats most errors generically, without distinguishing between validation, permission, or server errors.
- Validation errors are shown as raw messages in toast notifications, without field-level feedback in forms.

This inconsistency makes error handling harder to maintain and leads to poor user experience.

**Describe the solution you'd like**
Introduce a standardized error handling system across backend and frontend:

Backend:
- Define structured validation error types (e.g., field, message, code).
- Return structured error responses in GraphQL mutations instead of raising exceptions directly.
- Standardize error codes (e.g., INVALID_DATE, PERMISSION_DENIED, NOT_FOUND).
- Align error formatting between REST and GraphQL APIs.

Frontend:
- Implement a centralized error parser for structured backend errors.
- Support field-level validation errors in forms.
- Distinguish error types to provide appropriate UI feedback:
- Validation errors → inline field messages
- Permission errors → dedicated UI feedback
- Server errors → generic error toast

**Are you going to work on implementing this?**

- [x] Yes
- [ ] No

**Additional context**
Relevant parts of the codebase:
- Backend (GraphQL mutations):
`apps/mentorship/api/internal/mutations/module.py`
`apps/mentorship/api/internal/mutations/program.py`
- Backend (REST exception handler):
`apps/api/rest/v0/__init__.py`
- Frontend error handling:
`frontend/src/app/global-error.tsx`
`frontend/src/hooks/useIssueMutations.ts`
`frontend/src/components/forms/shared/formValidationUtils.ts`

A unified error handling approach will improve developer experience, maintainability, and user-facing validation feedback.

Reference: #2701

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.