apollographql / apollographql/apollo-server
Stack traces on subgraph fetches are propagated even when `includeStacktraceInErrorResponses` is false
- Dominant language
- TypeScript
- Stars
- 14k
- Forks
- 2k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 2
Description
### Issue Description
The `includeStacktraceInErrorResponses` is written to "enrich" errors with stack traces when enabled. But it does not _redact_ stack traces when disabled. If a subgraph includes `extensions.stacktrace` in its response, that will be forwarded to clients.
This is surprising, but relatively easy to fix with a `formatError` hook:
```js
const server = new ApolloServer({
gateway,
includeStacktraceInErrorResponses: false,
formatError: (formatted, original) => {
// THIS SHOULDN'T BE NECESSARY
if (formatted.extensions?.stacktrace) {
delete formatted.extensions.stacktrace;
}
return formatted;
},
});
```
### Link to Reproduction
https://github.com/lennyburdette/curly-succotash/blob/main/gateway.js#L14
### Reproduction Steps
_No response_
Contributor guide
Research direction
Start with the gateway.js reproduction linked in the issue and trace how ApolloServer handles subgraph errors when includeStacktraceInErrorResponses is false. Confirm the behavior with the supplied gateway configuration; done means subgraph extensions.stacktrace values are not forwarded to clients when stack traces are disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, javascript, typescript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100