Stop sending error message in bean validation response #625
Conversation
|
What does this fix? |
|
Can you provide a description regarding why this is desired? I don't understand the benefit of hiding these error messages from the user, especially the way we use the bean validator. |
|
The error messages are not being sanitized by the underlying framework so they could be used for XSS. |
|
Do they include user input, or just our own messages? I thought just the latter, so XSS wouldn't be an issue. It's fine to drop them, though... I think users should never see those error messages anyway, if they are using the web service with links from our own monitor app, because we'll never provide a link which generates such an error message (we shouldn't anyway). |
|
I tested it out running uno locally and this will work in firefox: |
3 participants
No description provided.