[5.5] Ensure uncaught exceptions are returned in JSON if required #18732

laurencei · 2017-04-08T15:44:29Z

The current framework behavior is to return full html in uncaught exceptions (such as a 500 internal error).

In 5.5/master there are already some changes which will forcibly return JSON if expectsJSON() is true - but only if app.debug = true.

I propose that if expectsJSON() is true - then we should always be returning JSON regardless of the debug setting.

iflamed

See the comment. The security, the exception code, the message translation is important.

iflamed · 2017-04-08T17:54:33Z

src/Illuminate/Foundation/Exceptions/Handler.php

+                'message' => $e->getMessage(),
+                'file' => $e->getFile(),
+                'line' => $e->getLine(),
+                'trace' => $e->getTrace(),


Sorry, I don't think we should response a different json in debug mode and the production mode.

Further more, the exception code (getCode()) may have much more valuable.

May be we should just hide the trace for some security consideration. Also we should consider the translation for the message.

Sorry, I don't think we should response a different json in debug mode and the production mode.

Taylor already added JSON stuff for debug in the master branch. This PR is not adding it.

We are just putting JSON for production when it was requested via AJAX.

You should just hide the trace in production. Or replace it with the exception's getCode. I think the translation for the message is really important. Could you add these code ?

Translation of exceptions should probably be a different PR though - as that is a separate to what is occurring in this PR?

Maybe, but it is relate these code, about the exception. It doesn't matter how the code work. Please consider the exception code, the translation. The file name and the exception line shown in production may not be safe for the server.

The file name and the exception line shown in production may not be safe for the server.

Correct - we only return the detailed information if debug is true.

laurencei · 2017-04-08T18:28:54Z

I looked around - there dont seem to be any framework tests for the Exceptions Handler?

I've added some tests to start some coverage, at least for these changes.

m1guelpf · 2017-04-08T19:03:21Z

@laurencei #18731 ?

laurencei · 2017-04-08T19:12:21Z

@m1guelpf - looks like we both created the PRs at similar times.

This PR is a different approach and takes into account the upcoming changes in 5.5/master.

thecrypticace · 2017-04-08T19:29:55Z

This is something I have to add to every Laravel app I write that has an API. It would be nice for something like this to be In core.

JosephSilber · 2017-04-09T02:51:32Z

src/Illuminate/Foundation/Exceptions/Handler.php

+                'trace' => $e->getTrace(),
+            ];
+        } else {
+            $response['message'] = $this->isHttpException($e) ? $e->getMessage() : 'Server Error';


I believe this to be clearer:

$response = [ 'message' => $this->isHttpException($e) ? $e->getMessage() : 'Server Error', ];

...since we're only now creating the response.

@JosephSilber - yeah, I was wondering about that. I've pushed an update. Thanks.

GrahamCampbell · 2017-04-09T14:51:16Z

src/Illuminate/Foundation/Exceptions/Handler.php

-        return $request->expectsJson() && config('app.debug')
-                        ? $this->prepareJsonResponse($request, $e)
-                        : $this->prepareResponse($request, $e);
+        return $request->expectsJson() ? $this->prepareJsonResponse($request, $e) : $this->prepareResponse($request, $e);


Please leave this on multiple lines how it was.

@GrahamCampbell - ok - fixed

lucasmichot · 2017-04-10T07:40:40Z

src/Illuminate/Foundation/Exceptions/Handler.php

+            ];
+        }
+
+        return response(json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES), $status, array_merge($headers, [


So we actually can only return JSON here, why not just:

return new JsonResponse($response, $status, $headers, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);

@return doblock should be changed accordingly

@lucasmichot - that line of code is basically what was already in the master branch. But I agree your way seems cleaner - so I've updated the PR.

lucasmichot · 2017-04-10T10:39:37Z

src/Illuminate/Foundation/Exceptions/Handler.php

@@ -212,22 +213,28 @@ protected function prepareResponse($request, Exception $e)
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Exception $e
-     * @return \Symfony\Component\HttpFoundation\Response
+     * @return \Illuminate\Http\JsonResponse
     */
    protected function prepareJsonResponse($request, Exception $e)
    {
        $status = $this->isHttpException($e) ? $e->getStatusCode() : 500;


I believe only one condition could be used here ?

@lucasmichot - I'm not sure what do you mean? If it is a HttpException - we will use the exception code we were given (i.e. 403). But if it is not a HttpException - then we need to cast it as a 500?

I meant that we can actually make this check only once:

if ($this->isHttpException($e)) { $status = $e->getStatusCode(); $headers = $e->getHeaders(); } else { $status = 500; $headers = []; }

Up to Taylor I guess? Those lines were what he wrote already in the master branch that currently exists. I'll leave it as is for this PR to keep changes to a minimum and we can review after?

SteamWind · 2017-09-26T08:48:37Z

Hello,
What if we want those HTML errors back in debug with json responses? Is there a way to setup this?

laurencei · 2017-09-26T19:54:44Z

You could override the exception handler - yes

ajax for errors

cd69e50

laurencei mentioned this pull request Apr 8, 2017

[5.5] Verbose TokenMismatch Error #18728

Merged

refactor clean up array

655d3ce

iflamed suggested changes Apr 8, 2017

View reviewed changes

laurencei added 2 commits April 8, 2017 18:26

add Foundation Exceptions tests

44166d6

remove unused class from test

4a4a6f6

improve tests

bc16cc7

m1guelpf mentioned this pull request Apr 8, 2017

[5.4] Return errors in JSON #18731

Closed

fix typo and use local variable

7b33de4

JosephSilber reviewed Apr 9, 2017

View reviewed changes

formatting

f04172f

GrahamCampbell requested changes Apr 9, 2017

View reviewed changes

formatting

84506c1

lucasmichot reviewed Apr 10, 2017

View reviewed changes

refactor JsonResponse

bf5d8c4

lucasmichot reviewed Apr 10, 2017

View reviewed changes

taylorotwell merged commit bf5d8c4 into laravel:master Apr 10, 2017

DanielDarrenJones mentioned this pull request Jun 4, 2017

[5.5] API Responses #19449

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[5.5] Ensure uncaught exceptions are returned in JSON if required #18732

[5.5] Ensure uncaught exceptions are returned in JSON if required #18732

laurencei commented Apr 8, 2017 •

edited

Loading

iflamed left a comment

iflamed Apr 8, 2017

laurencei Apr 8, 2017

iflamed Apr 8, 2017

laurencei Apr 8, 2017

iflamed Apr 8, 2017

laurencei Apr 8, 2017

laurencei commented Apr 8, 2017

m1guelpf commented Apr 8, 2017

laurencei commented Apr 8, 2017

thecrypticace commented Apr 8, 2017 •

edited

Loading

JosephSilber Apr 9, 2017

laurencei Apr 9, 2017 •

edited

Loading

GrahamCampbell Apr 9, 2017

laurencei Apr 9, 2017

lucasmichot Apr 10, 2017

laurencei Apr 10, 2017

lucasmichot Apr 10, 2017

laurencei Apr 10, 2017 •

edited

Loading

lucasmichot Apr 10, 2017

laurencei Apr 10, 2017

SteamWind commented Sep 26, 2017 •

edited

Loading

laurencei commented Sep 26, 2017

[5.5] Ensure uncaught exceptions are returned in JSON if required #18732

[5.5] Ensure uncaught exceptions are returned in JSON if required #18732

Conversation

laurencei commented Apr 8, 2017 • edited Loading

iflamed left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

laurencei commented Apr 8, 2017

m1guelpf commented Apr 8, 2017

laurencei commented Apr 8, 2017

thecrypticace commented Apr 8, 2017 • edited Loading

Choose a reason for hiding this comment

laurencei Apr 9, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

laurencei Apr 10, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SteamWind commented Sep 26, 2017 • edited Loading

laurencei commented Sep 26, 2017

laurencei commented Apr 8, 2017 •

edited

Loading

thecrypticace commented Apr 8, 2017 •

edited

Loading

laurencei Apr 9, 2017 •

edited

Loading

laurencei Apr 10, 2017 •

edited

Loading

SteamWind commented Sep 26, 2017 •

edited

Loading