Skip to content

feat: improve security by not returning uncaught exceptions to end-users - #966

Open
StijnCaerts wants to merge 2 commits into
stac-utils:mainfrom
StijnCaerts:feat/exception-security
Open

feat: improve security by not returning uncaught exceptions to end-users#966
StijnCaerts wants to merge 2 commits into
stac-utils:mainfrom
StijnCaerts:feat/exception-security

Conversation

@StijnCaerts

@StijnCaerts StijnCaerts commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Description:
By having an exception handler for the Python base Exception, all uncaught exception messages will be returned to the end-user. For security purposes, it is better to show a generic error message for uncaught exceptions as these might contain sensitive information. On the other hand, error handling for validating and processing user input can be improved in the application itself, eg. by explicitly raising an HTTPException with code 400 when parsing of a filter string fails.

This PR proposes to remove the exception handler for the Exception type, as a result end-users will get a generic HTTP 500 response without detail of the underlying exception raised.

PR Checklist:

  • pre-commit hooks pass locally
  • Tests pass (run make test)
  • Documentation has been updated to reflect changes, if applicable, and docs build successfully (run make docs)
  • Changes are added to the CHANGELOG.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant