hydra description for Error in prod env is not set

[Zayon]

When I throw an Exception in a custom controller, the exception message is put in the hydra:description field of the response only in dev env

Configuration :

# src/AppBundle/Resources/config/api_resources/resources.yml
AppBundle\Entity\Book:
    itemOperations:
        special:
            route_name: 'book_special'

# app/config/routing.yml
book_special:
    path: '/books/{id}/special'
    methods:  ['GET']
    defaults:
        _controller: 'AppBundle:Book:special'
        _api_resource_class: 'AppBundle\Entity\Book'
        _api_item_operation_name: 'special'

<?php
// src/AppBundle/Controller/BookController.php

namespace AppBundle\Controller;

use AppBundle\Entity\Book;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;

class BookController extends Controller
{
    public function specialAction($data)
    {
        throw new Exception('HERE IS MY MESSAGE');
    }
}

In dev env :

curl -X GET "http://myproject.local/app_dev.php/book/1/special" -H "accept: application/ld+json"

{
    "@context": "/app_dev.php/contexts/Error",
    "@type": "hydra:Error",
    "hydra:title": "An error occurred",
    "hydra:description": "HERE IS MY MESSAGE",
    "trace": [
        {
        }
     ]
}

In prod env :

curl -X GET "http://myproject.local/book/1/special" -H "accept: application/ld+json"

{
    "@context": "/contexts/Error",
    "@type": "hydra:Error",
    "hydra:title": "An error occurred",
    "hydra:description": "Internal Server Error"
}

[Zayon]

OK, thinking about it, this is indeed intended behavior as exception descriptions sometime provide sensible data that should not be exposed.

Still, I have cases where I'd like to let the client know what happened by providing a meaningful error description. How should I accomplish this ?

[soyuka]

#797 ?

[Zayon]

What I want to do is not intended in api-platform.
As we can see here :

core/src/Problem/Serializer/ErrorNormalizerTrait.php

Lines 29 to 31 in d2a6729

	if ($statusCode >= 500 && $statusCode < 600) {
	$message = Response::$statusTexts[$statusCode];
	}

A workaround would be to override api_platform.hydra.normalizer.error and api_platform.problem.normalizer.error services with a whitelist of Exceptions that are authorized to display their message, even in a not-debug mode.

[soyuka]

Isn't overriding the error normalizer good enough?

[Zayon]

I'm not sure to understand what you mean.

The solution I think about is overriding the api_platform.hydra.normalizer.error and api_platform.problem.normalizer.error to my own classes.

If this is what you mean then yes it's good enough and this issue can be closed.

[soyuka]

The solution I think about is overriding the api_platform.hydra.normalizer.error and api_platform.problem.normalizer.error to my own classes.

Exactly.

I'll leave this open, maybe that other people are interested in this feature.

[Simperfit]

Closing as we got no feedback. Maybe creating a doc PR could be something ?