apollographql / apollographql/apollo-server

Stack traces on subgraph fetches are propagated even when `includeStacktraceInErrorResponses` is false

Open
#7,608 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
14k
Forks
2k
Avg merge
2d 14h
Merged PRs (30d)
2

Description

### Issue Description

The `includeStacktraceInErrorResponses` is written to "enrich" errors with stack traces when enabled. But it does not _redact_ stack traces when disabled. If a subgraph includes `extensions.stacktrace` in its response, that will be forwarded to clients.

This is surprising, but relatively easy to fix with a `formatError` hook:

```js
const server = new ApolloServer({
gateway,
includeStacktraceInErrorResponses: false,
formatError: (formatted, original) => {
// THIS SHOULDN'T BE NECESSARY
if (formatted.extensions?.stacktrace) {
delete formatted.extensions.stacktrace;
}
return formatted;
},
});
```

### Link to Reproduction

https://github.com/lennyburdette/curly-succotash/blob/main/gateway.js#L14

### Reproduction Steps

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the gateway.js reproduction linked in the issue and trace how ApolloServer handles subgraph errors when includeStacktraceInErrorResponses is false. Confirm the behavior with the supplied gateway configuration; done means subgraph extensions.stacktrace values are not forwarded to clients when stack traces are disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, javascript, typescript
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.