Do not send stacktraces to clients
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.8k
- Forks
- 1.4k
- Avg merge
- 17h 58m
- Merged PRs (30d)
- 5
Description
There are a couple of places where we currently send stack traces back to clients in error cases:
- unhandled HTTP errors
- websocket method errors
We should avoid that as it allows 3rd parties to not only learn about our system (they also can do so from our repo), but in theory also about certain runtime configurations that we want to keep with ourselves. As we have no advantage of having those stack traces sent to clients, we can just disable those.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the handling paths for unhandled HTTP errors and websocket method errors, then read how their client-facing error responses are assembled. Confirm the behavior with the relevant error-handling tests or reproduce both cases; done means clients no longer receive stack traces in either error path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 40/100