gitpod-io / gitpod-io/gitpod

Do not send stacktraces to clients

Open
#9,156 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

aspect: security component: server meta: never-stale team: webapp type: improvement
Dominant language
TypeScript
Stars
13.8k
Forks
1.4k
Avg merge
17h 58m
Merged PRs (30d)
5

Description

There are a couple of places where we currently send stack traces back to clients in error cases:

  • unhandled HTTP errors
  • websocket method errors

We should avoid that as it allows 3rd parties to not only learn about our system (they also can do so from our repo), but in theory also about certain runtime configurations that we want to keep with ourselves. As we have no advantage of having those stack traces sent to clients, we can just disable those.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the handling paths for unhandled HTTP errors and websocket method errors, then read how their client-facing error responses are assembled. Confirm the behavior with the relevant error-handling tests or reproduce both cases; done means clients no longer receive stack traces in either error path.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
40/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.