停止在 WebAPI 中显示整个堆栈跟踪答案

【问题标题】：Stop displaying entire stack trace in WebAPI停止在 WebAPI 中显示整个堆栈跟踪
【发布时间】：2014-09-04 04:14:35
【问题描述】：

当WebAPI 发生意外错误时，用户会看到整个堆栈跟踪。

我认为显示整个堆栈跟踪是不安全的。

停止向我的用户显示整个跟踪的默认行为是什么？

只是一个友好的信息，比如单独说 Internal Server Error 就足够了。对吗？

有什么想法吗？

<?xml version="1.0"?>
<Error>
  <Message>An error has occurred.</Message>
  <ExceptionMessage>The method or operation is not implemented.</ExceptionMessage>
  <ExceptionType>System.NotImplementedException</ExceptionType>
  <StackTrace>   at MyCompany.BLL.RequirementOfService.Employee1.Employee1Service.MakeRequirementOfService(RequirementOfService RequirementOfService) in d:\Projects\MyFolder\Testing\WhiteBox\MyCompany.BAL.RequirementOfService\Employee1\Employee1Service.cs:line 37
   at MyCompany.BLL.RequirementOfService.RequirementOfServiceBLL.MakeRequirementOfService(RequirementOfService RequirementOfService) in d:\Projects\MyFolder\Testing\WhiteBox\MyCompany.BAL.RequirementOfService\RequirementOfServiceBLL.cs:line 76
   at MyCompany.RequirementOfService.Windsor.RequirementOfServiceProvider.MakeRequirementOfService(RequirementOfService RequirementOfService) in d:\Projects\MyFolder\Testing\WhiteBox\MyCompany.RequirementOfService\Windsor\RequirementOfServiceProvider.cs:line 47
   at MyCompany.RequirementOfService.RequirementOfService.Controllers.RequirementOfServiceController.Post(RequirementOfServiceDTO RequirementOfServiceDTO) in d:\Projects\MyFolder\Testing\WhiteBox\MyCompany.RequirementOfService\RequirementOfService\Controllers\RequirementOfServiceController.cs:line 87
   at lambda_method(Closure , Object , Object[] )
   at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.&lt;&gt;c__DisplayClass10.&lt;GetExecutor&gt;b__9(Object instance, Object[] methodParameters)
   at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.Execute(Object instance, Object[] arguments)
   at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ExecuteAsync(HttpControllerContext controllerContext, IDictionary`2 arguments, CancellationToken cancellationToken)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at System.Web.Http.Controllers.ApiControllerActionInvoker.&lt;InvokeActionAsyncCore&gt;d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

【问题讨论】：

标签： c# .net asp.net-web-api stack-trace asp.net-web-api2

【解决方案1】：

只需将配置IncludeErrorDetailPolicy更改为LocalOnly，详细信息不会发送给客户端。

这里：http://www.asp.net/web-api/overview/extensibility/configuring-aspnet-web-api

【讨论】：

有没有办法只是抑制堆栈跟踪，但保持消息完整？这样做似乎会删除所有异常信息。

【解决方案2】：

对于那些只想抑制 StackTrace 而不丢弃重要错误线索的人，您可以实现 ExceptionFilter。

您可以分两步完成：

按如下方式编写您的过滤器：

using System.Web.Http.Filters;
using System.Net;
using System.Net.Http;

public class MyExceptionFilterAttribute : ExceptionFilterAttribute
{
    public override void OnException(HttpActionExecutedContext context)
    {
        var request = context.Request;
        var response = request.CreateErrorResponse(HttpStatusCode.InternalServerError, context.Exception.Message);
        var content = (System.Net.Http.ObjectContent<System.Web.Http.HttpError>)response.Content;

        var errorValues = (System.Web.Http.HttpError)content.Value;
        errorValues["ExceptionMessage"] = context.Exception.Message;
        errorValues["ExceptionType"] = context.Exception.GetType().Name;
        if (context.ActionContext != null)
        {
            errorValues["ActionName"] = context.ActionContext.ActionDescriptor.ActionName;
            errorValues["ControllerName"] = context.ActionContext.ControllerContext.ControllerDescriptor.ControllerName;
        }

        context.Response = response;
    }
}

让 WebApi 使用你的 ExceptionFilter：

public static void Register(HttpConfiguration config)
{
    config.Filters.Add(new MyExceptionFilterAttribute());

你会得到这个：

{
  "Message": "Your exception is here!",
  "ExceptionMessage": "Your exception is here!",
  "ExceptionType": "Exception",
  "ActionName": "MyAction",
  "ControllerName": "MyController"
}

【讨论】：