update errorHandler templates

Author: loay

package.json

@@ -20,7 +20,7 @@
     "async": "^1.5.2",
     "cookie-parser": "^1.3.2",
     "debug": "^2.2.0",
-    "errorhandler": "^1.1.1",
+    "strong-error-handler": "^1.0.1",
     "fs-extra": "^0.30.0",
     "glob": "^7.0.0",
     "lodash": "^4.5.1",

server/config.json

@@ -20,7 +20,8 @@
     },
     "cors": false,
     "errorHandler": {
-      "disableStackTrace": false
+      "debug": true,
+      "log": true
     }
   },
   "legacyExplorer": false

server/middleware.json

@@ -17,6 +17,6 @@
     "loopback#urlNotFound": {}
   },
   "final:after": {
-    "errorhandler": {}
+    "strong-error-handler": {}
   }
 }

server/server.js

@@ -8,6 +8,7 @@ var path = require('path');
 var methodOverride = require('method-override');
 var app = module.exports = loopback();
 var boot = require('loopback-boot');
+var errorHandler = require('strong-error-handler');
 
 app.set('legacyExplorer', false);
 
@@ -103,8 +104,7 @@ app.use(loopback.urlNotFound());
  */
 
 // The ultimate error handler.
-app.use(loopback.errorHandler());
-
+app.use(errorHandler());
 /*
  * 5. Add a basic application status route at the root `/`.
  *

templates/projects/empty-server/data.js

@@ -78,9 +78,7 @@ template.server = {
         limit: '100kb',
       },
       cors: false,
-      errorHandler: {
-        disableStackTrace: false,
-      },
+      handleErrors: false,
     }},
     { name: 'legacyExplorer', value: false },
   ],

templates/projects/empty-server/files/server/middleware.development.json

@@ -0,0 +1,10 @@
+{
+  "final:after": {
+    "strong-error-handler": {
+      "params": {
+        "debug": true,
+        "log": true
+      }
+    }
+  }
+}

templates/projects/empty-server/files/server/middleware.json

@@ -13,7 +13,7 @@
     },
     "helmet#xssFilter": {},
     "helmet#frameguard": {
-      "params": [ 
+      "params": [
         "deny"
        ]
     },
@@ -26,7 +26,7 @@
     "helmet#hidePoweredBy": {},
     "helmet#ieNoOpen": {},
     "helmet#noSniff": {},
-    "helmet#noCache": { 
+    "helmet#noCache": {
       "enabled": false
     }
   },
@@ -47,6 +47,6 @@
     "loopback#urlNotFound": {}
   },
   "final:after": {
-    "loopback#errorHandler": {}
+    "strong-error-handler": {}
   }
 }

templates/projects/empty-server/files/server/middleware.production.json

@@ -19,6 +19,11 @@ var TestDataBuilder = require('./helpers/test-data-builder');
 var ref = TestDataBuilder.ref;
 var given = require('./helpers/given');
 var should = require('chai').should();
+// This may not work when the scaffolded application uses a different
+// loopback or loopback-boot version than the one used in loopback-workspace
+// Please make sure that versions are conform.
+var loopback = require('loopback');
+var boot = require('loopback-boot');
 
 var Workspace = workspace.models.Workspace;
 
@@ -983,6 +988,51 @@ describe('end-to-end', function() {
   });
 });
 
+  it('includes sensitive error details in development mode', function(done) {
+    var app = loopback({ localRegistry: true, loadBuiltinModels: true });
+    var bootOptions = {
+      appRootDir: SANDBOX + '/server',
+      env: 'development'
+    };
+    boot(app, bootOptions, function(err) {
+        request(app)
+          .get('/url-does-not-exist')
+          .expect(404)
+          .end(function(err, res) {
+            if (err) return done (err);
+            var responseBody = JSON.stringify(res.body);
+            expect(responseBody).to.include('stack');
+
+            done();
+        });
+    });
+  });
+
+  it('omits sensitive error details in production mode', function(done) {
+    var app = loopback({ localRegistry: true, loadBuiltinModels: true });
+    var bootOptions = {
+      appRootDir: SANDBOX + '/server',
+      env: 'production'
+    };
+    boot(app, bootOptions, function(err) {
+        request(app)
+          .get('/url-does-not-exist')
+          .expect(404)
+          .end(function(err, res) {
+            // Assert that the response body does not contain stack trace.
+            // We want the assertion to be robust and keep working even
+            // if the property name storing stack trace changes in the future,
+            // therefore we test full response body.
+             if (err) return done(err);
+             var responseBody = JSON.stringify(res.body);
+             expect(responseBody).to.not.have.property('stack');
+             expect(responseBody).to.not.include('stack');
+             expect(JSON.stringify(res.body, null, 2)).to.not.contain(__filename);
+             done();
+        });
+    });
+  });
+
 function setupConnection(done) {
   var connection = mysql.createConnection({
     database: MYSQL_DATABASE,