Fix Improper Error Handling in Blitz.js

In Blitz.js, improper error handling typically manifests during RPC (Remote Procedure Call) execution. When a mutation or query throws a raw exception—especially from Prisma or underlying system calls—the framework may serialize the entire error object, including stack traces, database schema metadata, and internal paths. This provides an attacker with a roadmap of your infrastructure. To secure a Blitz application, you must intercept raw exceptions and map them to sanitized, predefined Blitz Error classes.

The Vulnerable Pattern

import db from 'db';
export default async function updateSecretRecord(input) {
// VULNERABILITY: Raw database errors are thrown directly.
// If the query fails, Prisma returns detailed engine errors including table names and constraints.
const record = await db.secretRecord.update({
where: { id: input.id },
data: { content: input.content },
});
return record;
}

The Secure Implementation

The vulnerable code leaks internal database state by allowing Prisma exceptions to bubble up to the Blitz RPC layer. The secure implementation uses `resolver.pipe` for structured middleware execution and a try/catch block to intercept exceptions. By checking for specific error codes (like Prisma's P2025) and throwing Blitz-specific classes (NotFoundError, AuthenticationError), you ensure that the client only receives a sanitized message and a standard HTTP status code, while the sensitive stack trace is kept in server-side logs only.

import { resolver, NotFoundError, AuthenticationError } from 'blitz';
import db from 'db';
export default resolver.pipe(
resolver.authorize(),
async ({ id, content }) => {
try {
const record = await db.secretRecord.update({
where: { id },
data: { content },
});
return record;
} catch (error) {
// Log the actual error for internal debugging
console.error(‘[Internal Error]:’, error);
  // Map Prisma 'Record not found' error code (P2025) to a sanitized Blitz error
  if (error.code === 'P2025') {
    throw new NotFoundError('The requested resource does not exist.');
  }

  // Fallback to a generic error to prevent leaking stack traces
  throw new Error('An unexpected error occurred processing your request.');
}
}
);