Chapter 2 · Practice 3 of 4

Never send stack traces or database errors to clients

Why it matters

A stack trace or raw database error in a response tells an attacker your framework, file paths, table names and sometimes your query structure.

Split what you send from what you keep:

To the client: a short message and an error code.
To your logs: the full details, linked by a request id so you can find them.

Two settings also help:

Set NODE_ENV=production in production. Express then returns less verbose error pages.
Remove the X-Powered-By header, which advertises your framework for free.

Avoid