Fix Improper Error Handling in Falcon
Default Falcon behavior can be a goldmine for attackers. Leaking stack traces or internal logic via unhandled exceptions is a rookie move that leads to easy recon. We're going to squash that by implementing a global exception sink to ensure the client only sees what we want them to see, while we log the real dirt internally.
The Vulnerable Pattern
import falconclass BuggyResource: def on_get(self, req, resp): # This will raise a ZeroDivisionError. # Without a global handler, Falcon might return a traceback # or a generic error that reveals internal logic depending on the server config. result = 1 / 0 resp.media = {‘result’: result}
app = falcon.App() app.add_route(‘/leak’, BuggyResource())
The Secure Implementation
The fix utilizes 'app.add_error_handler(Exception, ...)' to intercept any unhandled exceptions before they reach the default framework response logic. By mapping the base 'Exception' class to a custom handler, we ensure that no raw Python tracebacks or sensitive variable states are ever serialized to the HTTP response body. We log the actual error and stack trace to a secure internal location for debugging, while the external attacker is met with a generic '500 Internal Server Error' that provides zero insight into the backend stack or logic.
import falcon import loggingSecure logging configuration
logging.basicConfig(level=logging.ERROR)
def global_exception_handler(ex, req, resp, params): # Log the full traceback internally for the blue team logging.error(f’Unhandled exception: {ex}’, exc_info=True)
# Return a sanitized, generic error to the client # Do NOT include the 'ex' message in the response raise falcon.HTTPInternalServerError( title='Internal Server Error', description='An unexpected error occurred. The incident has been logged.' )class HardenedResource: def on_get(self, req, resp): result = 1 / 0 resp.media = {‘result’: result}
app = falcon.App()
Catch-all handler for any exception inheriting from Exception
app.add_error_handler(Exception, global_exception_handler) app.add_route(‘/secure’, HardenedResource())
Your Falcon API
might be exposed to Improper Error Handling
74% of Falcon apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.