Merge pull request #1502 from digitalsadhu/suppress_stack_traces_in_production#564

Suppress error handler stack traces in production

Close #1502
Fix #564

lib/loopback.js

@@ -159,6 +159,9 @@ if (loopback.isServer) {
 
   loopback.urlNotFound = loopback['url-not-found'];
   delete loopback['url-not-found'];
+
+  loopback.errorHandler = loopback['error-handler'];
+  delete loopback['error-handler'];
 }
 
 /*
@@ -180,12 +183,6 @@ if (loopback.isServer) {
   loopback.faviconFile = path.resolve(__dirname, '../favicon.ico');
 }
 
-/*!
- * Error handler title
- */
-
-loopback.errorHandler.title = 'Loopback';
-
 /**
  * Add a remote method to a model.
  * @param {Function} fn

package.json

@@ -40,6 +40,7 @@
     "debug": "^2.1.2",
     "depd": "^1.0.0",
     "ejs": "^2.3.1",
+    "errorhandler": "^1.3.4",
     "express": "^4.12.2",
     "inflection": "^1.6.0",
     "loopback-connector-remote": "^1.0.3",
@@ -60,7 +61,6 @@
     "browserify": "^10.0.0",
     "chai": "^2.1.1",
     "cookie-parser": "^1.3.4",
-    "errorhandler": "^1.3.4",
     "es5-shim": "^4.1.0",
     "grunt": "^0.4.5",
     "grunt-browserify": "^3.5.0",

server/middleware/error-handler.js

@@ -0,0 +1,16 @@
+var expressErrorHandler = require('errorhandler');
+expressErrorHandler.title = 'Loopback';
+
+module.exports = errorHandler;
+
+function errorHandler(options) {
+  if (!options || options.includeStack !== false) {
+    return expressErrorHandler(options);
+  } else {
+    var baseHandler = expressErrorHandler(options);
+    return function errorHandler(err, req, res, next) {
+      delete err.stack;
+      return baseHandler(err, req, res, next);
+    };
+  }
+}

test/error-handler.test.js

@@ -0,0 +1,55 @@
+var loopback = require('../');
+var app;
+var assert = require('assert');
+var request = require('supertest');
+
+describe('loopback.errorHandler(options)', function() {
+
+  it('should return default middleware when options object is not present', function(done) {
+
+    //arrange
+    var app = loopback();
+    app.use(loopback.urlNotFound());
+    app.use(loopback.errorHandler({ log: false }));
+
+    //act/assert
+    request(app)
+      .get('/url-does-not-exist')
+      .end(function(err, res) {
+        assert.ok(res.error.text.match(/<ul id="stacktrace"><li> &nbsp; &nbsp;at raiseUrlNotFoundError/));
+        done();
+      });
+  });
+
+  it('should delete stack when options.includeStack is false', function(done) {
+
+    //arrange
+    var app = loopback();
+    app.use(loopback.urlNotFound());
+    app.use(loopback.errorHandler({ includeStack: false, log: false }));
+
+    //act/assert
+    request(app)
+      .get('/url-does-not-exist')
+      .end(function(err, res) {
+        assert.ok(res.error.text.match(/<ul id="stacktrace"><\/ul>/));
+        done();
+      });
+  });
+
+  it('should pass options on to error handler module', function(done) {
+    //arrange
+    var app = loopback();
+    app.use(loopback.urlNotFound());
+    app.use(loopback.errorHandler({ includeStack: false, log: customLogger }));
+
+    //act
+    request(app).get('/url-does-not-exist').end();
+
+    //assert
+    function customLogger(err, str, req) {
+      assert.ok(err.message === 'Cannot GET /url-does-not-exist');
+      done();
+    }
+  });
+});