Skip to content

[Bug?]: [security] Server stack trace sent to client on error in server action #1967

@yinonburgansky

Description

@yinonburgansky

Duplicates

  • I have searched the existing issues

Latest version

  • I have tested the latest version

Current behavior 😯

When throwing an error in a server action the Error is being serialized and sent to the client with the stack trace which poses a security issue leaking production code file locations and function names.

Expected behavior 🤔

At least on Production don't send server's stack traces to the client.

Steps to reproduce 🕹

Any error thrown in server action:

const myAction = action(async () => {
  'use server';
  throw new Error('my server error');
});

See stackblitz full example

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions