Yii2: Turn off showing exceptions in REST

[RomeroMsk]

By default Yii2 outputs array with exception info in REST controller response, even if YII_ENV = prod and YII_DEBUG = false. I think it is wrong behavior, because it is unsecure to show to API consumers exception messages like

SQLSTATE[42S22]: Column not found: 1054 Unknown column 'test' in 'where clause' The SQL being executed was: SELECT * FROM `table` WHERE `test`=1

What is the right and easy way to turn this off? Why not to change default behavior of REST classes to not show such information?

[cebe]

Should be changed to show no detailed info by default.

[samdark]

Not by default, it should depend on YII_DEBUG same as web exceptions do.

[qiangxue]

If YII_DEBUG is false, we should turn non-user exceptions into 500 HTTP exception with a fixed error message.

[RomeroMsk]

Yes, it will be good solution, will wait. Thanks!

[RomeroMsk]

Also for such user exceptions the 'type' field is not necessary, I think:

<response>
    <type>yii\web\BadRequestHttpException</type>
    <name>Bad Request</name>
    <message>Missing required parameters: test</message>
    <code>0</code>
    <status>400</status>
</response>

[bryglen]

I agree. that type isn't needed. would it be better if the user can customize the error format. there are some cases specially in production that it will only needed name and status, nothing more nothing else.

[samdark]

@RomeroMsk type is OK to include since it will be easy to write cosumer code i.e. there will be a single method of parsing exception JSON, not two separate methods and not one big method with ifs.

[RomeroMsk]

@samdark include the name of framework into type - is not good, I think.

[bryglen]

why not make it flexible to make it customizable by the developer?

possible solutions is to provide docs how to override the error class or have a configuration to the error response.

[RomeroMsk]

Cheked, works fine. Thank you! :+1: