What not to tell the client
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
avoid leaking internals.
Planned topics
- Never return stack traces, SQL, class names, or file paths.
- Database messages can reveal table names and values; map them to a safe message.
- Log the full exception server-side with a correlation id; give the client the id to quote.
- For unexpected errors return a generic 500 body.
Draft outline details
Demonstration
@ExceptionHandler(Exception.class)
ProblemDetail unexpected(Exception ex) {
log.error("Unhandled error", ex);
return ProblemDetail.forStatusAndDetail(HttpStatus.INTERNAL_SERVER_ERROR, "Unexpected error");
}Check your understanding
Where does the stack trace go?
Show answer
Into the server log, not the response.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.