Fix Improper Error Handling in Next.js

Improper error handling in Next.js applications is a prime vector for Information Disclosure (CWE-209). Leaking stack traces, raw database errors, or environment details allows attackers to map your internal architecture and identify vulnerable dependencies. Hardening your application requires sanitizing production responses while maintaining high-fidelity logging on the backend.

The Vulnerable Pattern

// pages/api/v1/data.js
export default async function handler(req, res) {
  try {
    const results = await db.execute(req.body.query);
    res.status(200).json(results);
  } catch (error) {
    // VULNERABLE: Leaks full error details, including SQL syntax and stack traces
    res.status(500).json({
      success: false,
      message: error.message,
      stack: error.stack
    });
  }
}

The Secure Implementation

The vulnerable example directly serializes the Error object to the client, exposing the 'message' and 'stack' properties. In a production environment, this could reveal database table names, internal file paths, or third-party API keys. The secure implementation follows the 'Fail-Safe' principle: it catches the exception, logs the diagnostic data to a secure server-side sink, and returns a generic status message. In Next.js App Router, ensure you use 'error.js' files as error boundaries to prevent the default development overlay from leaking data in production, and always leverage the 'use server' directive safely to avoid exposing logic.

// pages/api/v1/data.js
import { logger } from '@/utils/logger';
export default async function handler(req, res) {
try {
// Validate input and execute logic
const results = await db.execute(‘SELECT * FROM table WHERE id = ?’, [req.body.id]);
res.status(200).json({ success: true, data: results });
} catch (error) {
// SECURE: Log sensitive details to internal monitoring, NOT the client
logger.error({ err: error, body: req.body }, ‘Internal API Failure’);
// Return an opaque error reference
res.status(500).json({
  success: false,
  message: 'An unexpected error occurred.',
  reference: req.headers['x-request-id'] || 'none'
});
}
}