Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hide Model namespace in ModelNotFoundException class in production mode. #34570

Closed
wants to merge 2 commits into from
Closed

Hide Model namespace in ModelNotFoundException class in production mode. #34570

wants to merge 2 commits into from

Conversation

abdrzakoxa
Copy link

Description:

I just want to suggest improvement in ModelNotFoundException class, because when the app is in production any one can send http request for non exist record and the app will response this:

{
"message": "No query results for model [App\\Models\\User] 1"
}

So the (developer or hacker) can understand how your app was developed and structure of your models ... and this is bad.
it's best to keep my app secure.

This message is good when app is in local env and this message the normal user can't understand that namespace ...

Steps To Reproduce:

api.php

Route::get('/user/{user}', static function (\App\Models\User $user) {
return 'good';
});

use POSTMAN or INSOMNIA

and send http request for non exists user for example: user/9999

@abdrzakoxa abdrzakoxa changed the title Hide Model namespace in production mode. Hide Model namespace in ModelNotFoundException class in production mode. Sep 28, 2020
@taylorotwell
Copy link
Member

No plans to change this. Unclear how knowing your namespace structure is a security risk.

@taylorotwell
Copy link
Member

You could also send any response you wanted in your own exception handler.

@abdrzakoxa abdrzakoxa deleted the hide-namespace-in-production-mode branch September 28, 2020 20:48
@abdrzakoxa
Copy link
Author

abdrzakoxa commented Sep 28, 2020

I know i can handle it in my own exception handler, but i think its not good to show namespace in message by default in laravel!

but it's not a big issue just suggest if you like it...

Thanks @taylorotwell for your reaction

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants