Error responses do not leak stack traces or internal details

Stack traces and internal error details handed back in API responses are reconnaissance gifts. CWE-209 (Generation of Error Message Containing Sensitive Information) and CWE-200 (Exposure of Sensitive Information to Unauthorized Actors) cover the pattern. OWASP API Security Top 10 2023 API8 (Security Misconfiguration) specifically calls out verbose error responses. A stack trace reveals internal library versions (useful for finding known CVEs), file system paths (useful for traversal attacks), database query structure (useful for injection), and internal service names. Frameworks default to verbose errors in development — that default must be explicitly reversed for production, and the mechanism for that reversal must be tested.

Centralize all error handling so internal details are logged server-side and a safe, generic message is returned to the client. Never pass error.message or error.stack directly to the response body.

// src/lib/api-error.ts
export class ApiError extends Error {
  constructor(public status: number, message: string) {
    super(message)
  }
}

export function handleApiError(error: unknown): Response {
  if (error instanceof ApiError) {
    return Response.json({ error: error.message }, { status: error.status })
  }
  // Log full details server-side
  console.error('[API Error]', error)
  // Return generic message to client — no stack, no internals
  return Response.json(
    { error: 'Internal server error' },
    { status: 500 }
  )
}

// In route handlers:
export async function GET(req: Request) {
  try {
    // ... logic
  } catch (err) {
    return handleApiError(err)
  }
}