Skip to content

fix: Remove internal exception details from API error responses (apn-f6iqg)#296

Merged
paulvanbrenk merged 1 commit intomainfrom
merge/apn-g9ds3l
Feb 16, 2026
Merged

fix: Remove internal exception details from API error responses (apn-f6iqg)#296
paulvanbrenk merged 1 commit intomainfrom
merge/apn-g9ds3l

Conversation

@paulvanbrenk
Copy link
Collaborator

Summary

  • Removes ex.Message and ex.InnerException?.Message from API error responses in UserRoutes.cs
  • Adds server-side ILogger calls to preserve full exception details for debugging
  • Prevents information disclosure of internal paths, DB errors, and stack traces to API clients

Test plan

  • All 392 tests pass (dotnet test PatchNotes.slnx)
  • Clean rebase onto current main

MR: apn-g9ds3l | Bead: apn-f6iqg | Worker: furiosa

…nses (apn-f6iqg)

Error responses in the PUT /api/users/me endpoint were leaking ex.Message
and stytchUserId to API clients. Now logs full exception details server-side
via ILogger and returns only generic error messages to clients.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@paulvanbrenk paulvanbrenk merged commit d74d2ce into main Feb 16, 2026
4 checks passed
@paulvanbrenk paulvanbrenk deleted the merge/apn-g9ds3l branch February 16, 2026 16:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments