Errors in route handlers are not caught

The following web server :

import polka from 'polka';

polka()
  .get('/*', () => { throw new Error("i am an error") })
  .listen(3000);

exits completely when receiving any request.

This is a quite unexpected behavior that causes serious denial of service vulnerabilities for users of the framework. The usual safer behavior adopted by other frameworks is to catch errors at the request level so that a single request cannot bring the entire web server down.

See for instance https://github.com/sveltejs/kit/issues/1523

[lovasoa]

Users not catching their own handler errors is not a security issue. That would mean all runtime errors in all of JS must be classified as security vulnerabilities.

I understand what you mean, and you may indeed want to consider that the vulnerability is in the user’s code if they do not wrap every single handler in a try…catch, but then you would need to make that very explicit in the documentation, and update the usage examples.

This is not the standard security approach taken by other frameworks, and in this case, starting the documentation about routing with

If you’re coming from Express, there’s nothing new here!

is very dangerous.

Crashing an entire web server when an error occurs in a single request is quite serious.

[lukeed]

Closing as a duplicate of #12

This is already fixed in polka@next & I recommend you use that instead. There’s a workaround here if you still want to use the 0.5.x release: https://github.com/lukeed/polka/issues/12#issuecomment-486089751