mORMot Open Source

dcoun

Member

From: Crete, Greece

Registered: 2020-02-18

Posts: 430

Error description when parameter is missing in a rest interface call

I noticed that if a parameter is missing when calling a Rest interface procedure, Mormot2 returns a useful description of the problem:
{
    "errorCode": 406,
    "errorText": "IRestinterface.myprocedure failed parsing 2ndparameter: UTF8String from input JSON"
}
This can be very helpful for debugging but I prefer a more generic error like "Missing parameter from call" or "Incorrect call" in a production environment.
Is it possible? Thank you in advance

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,661

Website

Re: Error description when parameter is missing in a rest interface call

Not directly.

dcoun

Member

From: Crete, Greece

Registered: 2020-02-18

Posts: 430

Re: Error description when parameter is missing in a rest interface call

If I want to return such  as the above kind of message as a response result after parameters' range check how can I do it?
I tried to use the following:
ServiceRunningContext.Request.Call.OutBody:='';
ServiceRunningContext.Request.Call.OutStatus:=406;
ServiceRunningContext.Request.Error('%',['Incorrect parameter'],406);
but without success
Thank you @ab

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,661

Website

Re: Error description when parameter is missing in a rest interface call

In mORMot 1, there was only limited information, as you expected.

In mORMot 2, I added more information, because the lack of parameter name was confusing in some cases.
One usual problem was a DTO parameter defined as record, allocated on the stack and not initialized with zeros, which had some garbage content for enumerate fields, therefore had serialization errors due to out of range values.
The new message is more explicit.

Why do you want the error message to be less explicit?
To avoid forensic on a public API?
But I guess this is not worth it, because you should better secure the link and use authentication, otherwise you will have bigger problems that just error messages -mainly DDOS attacks.

dcoun

Member

From: Crete, Greece

Registered: 2020-02-18

Posts: 430

Re: Error description when parameter is missing in a rest interface call

To be honest, I noticed  the extended information in an interface that was public without authentication.
I agree with your arguments, it is better to have more extensive information on error and authentication is the solution. No problem for such a case
I will put the last question in an other thread as it is not connected with the above.