Description
The errorhandler middleware creates detailed error responses for development. Registering it without limiting it to development may disclose exception messages, stack traces and internal objects to clients. Attackers can use this information to investigate internal paths, framework behavior and ways to trigger errors.
Potential impact
- Stack traces, internal file paths and environment details may be exposed to external users.
- Detailed errors may help attackers refine subsequent attacks.
- Development features left in production may undermine security policy and consistent error handling.
Remediation
- Use
errorhandler()only in development; do not register it in production or an environment exposed to the internet. - When needed, enable it only within an explicit development check such as
process.env.NODE_ENV === "development"orapp.get("env") === "development". - Return generic 5xx responses in production. Record detailed exceptions only in restricted server logs, removing secrets.
Examples
Before
javascript
const express = require("express");
const errorhandler = require("errorhandler");
const app = express();
app.use(errorhandler());
After
javascript
const express = require("express");
const errorhandler = require("errorhandler");
const app = express();
if (process.env.NODE_ENV === "development") {
app.use(errorhandler());
}
Explanation:
- Before: Development error responses are enabled in every environment and may expose internal details.
- After: The middleware is registered only for development. Implement a separate generic production error handler and explicitly configure the deployment environment value.