How do you prevent sensitive information from leaking through exception responses in production NestJS apps?

Q: How do you prevent sensitive information from leaking through exception responses in production NestJS apps?

@Catch() export class SafeExceptionFilter implements ExceptionFilter { constructor( private readonly logger: LoggerService, private readonly config: ConfigService, ) {} catch(exception: unknown, host: ArgumentsHost): void { const ctx = host.switchToHttp(); const res = ctx.getResponse (); const req = ctx.getRequest (); const isProd = this.config.get('NODE_ENV') === 'production'; let status = 500; let message = 'Internal server error'; let details: unknown; if (exception instanceof HttpException) { status = exception.getStatus(); const body = exception.getResponse(); message = typeof body === 'string' ? body : (body as any).message; // Only expose validation details on 4xx — never on 5xx if (status < 500) details = typeof body === 'object' ? body : undefined; } else { this.logger.error(String(exception), (exception as Error)?.stack); // Dev only: include stack trace in response for easier debugging if (!isProd) details = { stack: (exception as Error)?.stack }; } res.status(status).json({ statusCode: status, message, ...(details ? { details } : {}), path: req.url, }); } } Never include stack traces, SQL queries, or file paths in production error responses. Only expose validation error details (field names, constraint messages) on 4xx client errors. Always return a generic message for 5xx errors — internal details are for server logs only. Log the full error including stack trace server-side before sending the sanitized response. Use ConfigService to branch on NODE_ENV — never hardcode environment checks.

Difficulty: 5/10

Exception handling, Security, Error filtering

Branch on NODE_ENV inside the filter. In production, log the full error but return only a generic 500 message to the client. In development, include the stack trace in the response for easier debugging. Never include database error messages, stack traces, or internal paths in production responses.

Environment-aware safe exception filter

Production security rules for error responses:

1
Never include stack traces, SQL queries, or file paths in production error responses.
2

How do you prevent sensitive information from leaking through exception responses in production NestJS apps?

Difficulty: 5/10

Exception handling, Security, Error filtering

Branch on NODE_ENV inside the filter. In production, log the full error but return only a generic 500 message to the client. In development, include the stack trace in the response for easier debugging. Never include database error messages, stack traces, or internal paths in production responses.

Environment-aware safe exception filter

Production security rules for error responses:

1
Never include stack traces, SQL queries, or file paths in production error responses.
2

How do you prevent sensitive information from leaking through exception responses in production NestJS apps?

Branch on NODE_ENV inside the filter. In production, log the full error but return only a generic 500 message to the client. In development, include the stack trace in the response for easier debugging. Never include database error messages, stack traces, or internal paths in production responses.

How do you prevent sensitive information from leaking through exception responses in production NestJS apps?

Branch on NODE_ENV inside the filter. In production, log the full error but return only a generic 500 message to the client. In development, include the stack trace in the response for easier debugging. Never include database error messages, stack traces, or internal paths in production responses.

Scenario Questions

Follow-up Questions