Prod stacktraces are returned to client for unhandled 500 errors

[alxndrsn]

E.g.

$ curl 2>/dev/null https://dev.getodk.cloud/v1/sessions \
    --header 'content-type: application/json' \
    --data '{"email":{},"password":{}}' | jq .
{
  "message": "Completely unhandled exception: Unexpected value expression.",
  "details": {
    "stack": [
      "TypeError: Unexpected value expression.",
      "at sql (/usr/odk/node_modules/slonik/dist/src/factories/createSqlTag.js:45:23)",
      "at equals (/usr/odk/lib/util/db.js:197:12)",
      "at _getSql (/usr/odk/lib/model/query/users.js:66:9)",
      "at /usr/odk/lib/model/query/users.js:74:12",
      "at Object.module.<computed> [as getByEmail] (/usr/odk/lib/model/container.js:30:33)",
      "at /usr/odk/lib/resources/sessions.js:24:18",
      "at /usr/odk/lib/http/endpoint.js:141:26",
      "at processTicksAndRejections (internal/process/task_queues.js:95:5)",
      "at async Object.transaction (/usr/odk/node_modules/slonik/dist/src/connectionMethods/transaction.js:22:24)",
      "at async Object.createConnection (/usr/odk/node_modules/slonik/dist/src/factories/createConnection.js:96:18)"
    ]
  }
}

Possibly written at: https://github.com/getodk/central-backend/blob/master/lib/http/endpoint.js#L202-L211

[alxndrsn]

Related to #448

[issa-tseng]

yeah i did do this intentionally.. better to have error information than not and it's an open source project anyway.

[alxndrsn]

it's an open source project anyway

Servers running open source software still have secrets 🙃

Example: brianc/node-postgres#1568

[issa-tseng]

sure but a stack trace? things are hard enough to debug w community software ..

[matthew-white]

We don't surface the stack trace in Frontend, and in practice over the years, I don't think we've used the stack property much for debugging. The same errors are logged in the service container, and we often ask users for those logs, which can provide additional information. The risk here doesn't seem very high to me, but I do think that it's nonzero. Given that we can get the same information another way, I'd support removing the property.

[alxndrsn]

One example of something you wouldn't want forwarded to a user: brianc/node-postgres#3145