Uploaded image for project: 'Tapestry 5'
  1. Tapestry 5
  2. TAP5-2768

DefaultRequestExceptionHandler shouldn't send Exception message in production

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Minor
    • Resolution: Fixed
    • 5.8.3
    • 5.8.4
    • tapestry-core
    • None

    Description

      The DefaultRequestExceptionHandler shouldn't write the actual Exception message to the Request header X-Tapestry-ErrorMessage in production mode.

      Instead, a generic "An error occurred." should be used, as the message exposes app internals.

      The client-side code in ajax.coffee only uses the header detecting if an error occurred and logging it to console.error, so its actual value is irrelevant.

      Omitting the header completely would mean reworking ajax.coffee, as the header indicates that the response might contain HTML content for the exception frame.

      Attachments

        Activity

          People

            ben-ng Ben Weidig
            ben-ng Ben Weidig
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: