I have a Jersey server that handles REST requests where I've implemented a RuntimeExceptionsMapper implements ExceptionMapper<RuntimeException>. If there's an unexpected exception, it handles it by logging the exception internally, and returning a 500 with the text "Server Error". I don't want to leak any information like framework or library versions to my users if they discover an error.

Should I also implement something to handle java.lang.Errors? These are mostly unrecoverable errors, like StackOverflow, OutOfMemory, or VirtualMachine errors. General advice surrounding errors is "Don't catch them, the JVM is in an unrecoverable state, let your application die." However, it seems to me that if I get to the ExceptionMapping phase, something else internal to Jersey has already caught the error and is trying to handle it. In that case, I still don't want to reveal to my users that I'm using version X.Y.Z of Jersey. Should I try to format a message, or is this just making a bad situation worse?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.