Repository navigation
HttpExceptionFilter hides legitimate 4xx messages in production because its sensitive-word patterns are too broad #1488
Description
In production sanitizeMessage replaces any message matching /token/i, /hash/i, /password/i, /duplicate/i, /database/i or /e\.?r\.?r\.?o\.?r\.?/i (which matches the plain word 'error') with a generic 'An unexpected error occurred', and it applies to client errors as well as 5xx. Messages such as 'Invalid hash format. Expected 64-character ...', 'Invalid refresh token' and validation errors that mention a password rule are replaced while keeping their 4xx status, so users and the frontend get no usable explanation.
Where
backend/src/common/filters/http-exception.filter.ts
Suggested fix
Sanitise only non-HttpException errors (and 5xx), return stable errorCodes for expected failures, and test the filter with real exception types.
Acceptance criteria
- Client-facing 4xx messages are preserved in production
- Unexpected errors still return a generic message
- Filter spec covers both
Activity
demilade18-git commentedon Oct 17, 2026
@demilade18-git has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @demilade18-git to this issue.
OffixialSydney commentedon Oct 17, 2026
@OffixialSydney has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @OffixialSydney to this issue.
drips-wave commentedon Oct 17, 2026
Congratulations, @demilade18-git! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @demilade18-git: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
demilade18-git: bounded pagination + trusted client IP (#1488-#1491)
Merge pull request #1549 from demilade18-git/demilade-issues-1488-1491
grantfox-oss commentedon Oct 17, 2026
🎉 This issue has been marked as completed on GrantFox!
@demilade18-git's PR #1549 was approved and merged by @mftee.
🏆 @demilade18-git: You earned 40 FoxPoints for this contribution! Your current tier: Builder (2,228 total points). Track your full progress on GrantFox.
👏 Great work, @demilade18-git! Keep contributing to CodeGirlsInc.
drips-wave commentedon Oct 17, 2026
This issue has been completed by @demilade18-git as part of the Stellar Wave Program's 10th Wave 🥳
😎 @demilade18-git: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.