NotFoundResult throws NullReferenceException

Description

When an id is not found on a GetAsync(id) request, the controller properly returns a NotFoundResult. However, this seems to break after that and what is actually returned to the client is a NullReferenceException.

Most concerning from a security standpoint is that the stack trace is returned.

The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (hacker). These messages reveal implementation details that should never be revealed.

Reference: Improper Error Handling

I updated my sample repo with a simple integration test (NotFound) that reproduces this behavior. Please advise if I am missing something. …

Environment

• JsonApiDotNetCore Version: 4.0.0-alpha3
• Other Relevant Package Versions: not sure

[crgolden]

the stack trace is returned

I see where there is a method DisableDetailedErrorsIfProduction that is disabling these errors if the “ASPNETCORE_ENVIRONMENT” environment variable equals “Production”, but not everyone’s production environments set that variable to the same value.

The method is setting the DisableErrorStackTraces and DisableErrorSource properties on the JsonApiOptions class, but when I try to set the same properties on the JsonApiOptions class available in the AddJsonApi method, they aren’t there. Could these options be added to setup for people whose production environments set the “ASPNETCORE_ENVIRONMENT” variable to something besides “Production” (like “prod”, etc.)?

[wisepotato]

@crgolden Chris, thanks for your effort to indicate problems with JADNC, a lot of points are valid.