'nestjs / graphql : default exception filter discloses too much sensitive data

The docs at https://docs.nestjs.com/graphql/other-features#exception-filters only says :

Nest standard exception filters are compatible with GraphQL applications as well. As with ExecutionContext, GraphQL apps should transform the ArgumentsHost object to a GqlArgumentsHost object.

In the "default" doc at https://docs.nestjs.com/exception-filters, we see

the built-in exception filter generates the following default JSON response:

followed by a very simple JSON

however, when I execute a route that does throw an error (Db not available), here is the output I have :

{
  "errors": [
    {
      "message": "connect ECONNREFUSED 127.0.0.1:5432",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "createMessage"
      ],
      "extensions": {
        "code": "INTERNAL_SERVER_ERROR",
        "exception": {
          "errno": -61,
          "code": "ECONNREFUSED",
          "syscall": "connect",
          "address": "127.0.0.1",
          "port": 5432
        }
      }
    }
  ],
  "data": null
}

As you can see, lots of sensitive data are sent to the client (instead of the simple "Internal server error" mentionned in the docs)

Note that I configured (temporarily) NODE_ENV=production

Also note that my codebase does not contain any @Catch so I assume that I am using the default behavior

Can someone explains what is happening here ? Is the default exception filter not active by default in graphql ?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source