Internal Service Name Exposure in Error Messages

[mackee]

When the client sends a request that does not conform to the Protobuf schema, internal service names and other details are exposed in the error message.

Example

For instance, when making an invalid JSON request in Connect RPC, the error message is as follows:

{
  "code":"invalid_argument",
  "message":"unmarshal message: unmarshal into *foov1.BarServiceLoginRequest: proto: (line 1:48): invalid value for string type: 1234"
}

Question

Is there a way to prevent internal information like *foov1.BarServiceLoginRequest from being exposed in error messages?

[akshayjshah]

There's some previous discussion of this in #584. The current solution is to provide your own implementation of the Codec interface for binary protobuf and/or protojson.

Can you share a little more about why you consider this sensitive? The service name is already in the URL - that's part of both the gRPC and Connect protocols. In most cases, the server also distributes schemas and/or generated client code, so the name of the request message isn't sensitive either.

[mackee]

@akshayjshah

There's some previous discussion of this in #584. The current solution is to provide your own implementation of the Codec interface for binary protobuf and/or protojson.

Thank you. I will consider that approach.

Can you share a little more about why you consider this sensitive? The service name is already in the URL - that's part of both the gRPC and Connect protocols. In most cases, the server also distributes schemas and/or generated client code, so the name of the request message isn't sensitive either.

• This issue was pointed out when a third-party vulnerability assessment partner reviewed the application I developed.
• As you mentioned, I also understand that this error does not reveal any new information. However, it seems that vulnerability assessments sometimes point out such issues.
• While this might not be a problem in many environments, it would be helpful to have a simple way to handle these kinds of errors.