GuardAPI Logo
GuardAPI
Automated Security Protocol

How to fix Improper Error Handling
in ServiceStack

Executive Summary

Improper error handling in ServiceStack is an information disclosure goldmine. By default, verbose stack traces and internal state can be leaked through the ResponseStatus object. Attackers use these leaks to map internal logic, identify vulnerable library versions, and extract database schema details. Hardening requires disabling debug modes and implementing strict global exception sanitization.

The Vulnerable Pattern

VULNERABLE CODE
public class AppHost : AppHostBase {
    public override void Configure(Container container) {
        // CRITICAL: DebugMode leaks stack traces and environment details
        SetConfig(new HostConfig { 
            DebugMode = true 
        });
    }
}

public class MyService : Service {
public object Any(UserRequest request) {
// VULNERABLE: Bubbling raw exceptions to the client
var user = Db.SingleById(request.Id);
if (user == null) throw new Exception(“User not found in DB: ” + Db.ConnectionString);
return user;
}
}

The Secure Implementation

The remediation focuses on three layers. First, 'DebugMode' is explicitly set to false to prevent ServiceStack's default behavior of appending stack traces to the 'ResponseStatus' DTO. Second, a global 'ServiceExceptionHandlers' is registered to intercept any unhandled exceptions, ensuring that even unexpected crashes result in a sanitized, generic error message rather than a raw dump. Finally, services use the 'HttpError' class to return controlled HTTP status codes and user-friendly messages, preventing sensitive data like connection strings or logic paths from reaching the client.

SECURE CODE
public class AppHost : AppHostBase {
    public override void Configure(Container container) {
        SetConfig(new HostConfig {
            DebugMode = false, // Disable verbose output
            ReturnsInnerException = false
        });

    // Global handler to sanitize all unhandled exceptions
    this.ServiceExceptionHandlers.Add((httpReq, request, exception) => {
        // Log the actual error internally
        Log.Error($"Error: {exception.Message}", exception);
        // Return a generic error DTO to the client
        return DtoUtils.CreateErrorResponse(request, new Exception("An internal service error occurred."));
    });
}


}


public class MyService : Service {
public object Any(UserRequest request) {
try {
var user = Db.SingleById(request.Id);
if (user == null) throw new HttpError(HttpStatusCode.NotFound, “Resource not found”);
return user;
} catch (Exception ex) when (!(ex is HttpError)) {
Log.Error(ex);
throw new HttpError(HttpStatusCode.InternalServerError, “Internal Server Error”);
}
}
}

System Alert • ID: 9564
Target: ServiceStack API
Potential Vulnerability

Your ServiceStack API might be exposed to Improper Error Handling

74% of ServiceStack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X