Error Responses

Overview

Never expose internal errors. Return structured, safe error responses.

Raw error messages leak implementation details, aid attackers, and confuse users. Errors should be safe, consistent, and actionable.

When to Use

• Implementing error handling in APIs
• Returning error responses to clients
• Catching exceptions in controllers
• Asked to "just return the error message"

The Iron Rule