postrank-labs/goliath — Issue #146: HTTP error messages should not leak back end details.
Author: hedgehog
Created: 2012-02-17 02:24:09+00:00
State: open

With this API:

class MyApi < Goliath::API

use Goliath::Rack::Tracer # log trace statistics
use Goliath::Rack::DefaultMimeType # cleanup accepted media types
use Goliath::Rack::Params # parse & merge query and body parameters
use Goliath::Rack::Heartbeat # respond to /status with 200, OK (monitoring, etc)

# If you are using Golaith version <=0.9.1 you need to Goliath::Rack::ValidationError
# to prevent the request from remaining open after an error occurs
#use Goliath::Rack::ValidationError
use Goliath::Rack::Validation::RequestMethod, %w(POST) # allow POST requests only
#use Goliath::Rack::Validation::RequiredParam, {:key => 'echo'} # must provide ?echo= query or body param

plugin ::Goliath::Plugin::Latency # output reactor latency every second

post "/mine", MyAPI

def response(env)
raise RuntimeException.new("#response is ignored when using maps, so this exception won't raise. See spec/integration/rack_routes_spec.")
end

end

and this spec:

it "should be a 500 on empty POST" do
with_api(MyApi) do
post_request({}, err) do |c|
c.response_header.status.should == 500
c.response.should match /Some informative yet generic message/
c.response_header['CONTENT_LENGTH'].should == '2'
end
end
end

you will see that the reponse tells the end user something about the back end implementation:

expected "{\"error\":\"uninitialized constant MyApi::RuntimeException\"}" to match /Some informative yet generic message/