Hiding error message in Node.js&Express from POST access

user_8300651 0
Viewed 4833

I'm running a Restful API Server based on Node.js using Express.js.

Today, I realized that someone can get information of error of my source code, including directory path of my server, when he send request using Curl like curl -X POST ~.

Error message I get:

TypeError: Cannot read property 'text' of undefined at exports.list (/usr/local/node/XXX/routes/message.js:49:36) at callbacks (/usr/local/node/XXX/node_modules/express/lib/router/index.js:124:37) at param (/usr/local/node/XXX/node_modules/express/lib/router/index.js:118:11) at param (/usr/local/node/XXXv/node_modules/express/lib/router/index.js:125:11)

How can I hide those critical information when the server displays errors?

express node.js
4 Answers

I'd set the NODE_ENV flag to production, as the Express.JS doesn't send the stack data in this mode. I recommend you to check out the dotenv module in npm.

user_107756570

If you pass an error to next() and you do not handle it in a custom error handler, it will be handled by the built-in error handler; the error will be written to the client with the stack trace. The stack trace is not included in the production environment.

https://expressjs.com/en/guide/error-handling.html

Set your environment variable NODE_ENV to production when running Node.js to suppress stack traces. It’ll still be shown on the console.

user_45100330
Related