'nestjs / graphql : default exception filter discloses too much sensitive data
The docs at https://docs.nestjs.com/graphql/other-features#exception-filters only says :
Nest standard exception filters are compatible with GraphQL applications as well. As with ExecutionContext, GraphQL apps should transform the ArgumentsHost object to a GqlArgumentsHost object.
In the "default" doc at https://docs.nestjs.com/exception-filters, we see
the built-in exception filter generates the following default JSON response:
followed by a very simple JSON
however, when I execute a route that does throw an error (Db not available), here is the output I have :
{
"errors": [
{
"message": "connect ECONNREFUSED 127.0.0.1:5432",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"createMessage"
],
"extensions": {
"code": "INTERNAL_SERVER_ERROR",
"exception": {
"errno": -61,
"code": "ECONNREFUSED",
"syscall": "connect",
"address": "127.0.0.1",
"port": 5432
}
}
}
],
"data": null
}
As you can see, lots of sensitive data are sent to the client (instead of the simple "Internal server error" mentionned in the docs)
Note that I configured (temporarily) NODE_ENV=production
Also note that my codebase does not contain any @Catch
so I assume that I am using the default behavior
Can someone explains what is happening here ? Is the default exception filter not active by default in graphql ?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|