Sanitizing `ClientErrorException` with 409 status code

Question

This issue to the dev team of resteasy. I cannot create an issue for you on the github.com. Hope you read this resource regurlaly.

The post request is sent with proxy-based resteasy client. The server returns 409 response code and inside of response body the error description in json format:

{
  "status" : "CONFLICT",
  "message" : "The defined ID is already in use"
}

To handle errors later and extract all required data from both request and response, we assing in the client request response filter this information via custom response header.

Now, at least with version 6.2.4.Final you handle this error in a specific way. You sanitize response, see WebApplicationExceptionWrapper#sanitize. You don't only reset all the original response headers and leave only 2, you also entiryly reset all the information about the entity, with error description. Literally the worst possible way to handle errors.

Please change this logic, cause it is not possible without other hacks/workarounds to identify the error and what triggered that error.

Answer 1

For the issues RESTEasy uses JIRA. There is an open JIRA along these lines.

This change was done intentionally and won't be reverted because of an information disclosure CVE. That said you can revert to the old behavior by setting the resteasy.original.webapplicationexception.behavior property to true.