[DOC] document http.detailed_errors.enabled config option & related security considerations

[rursprung]

What do you want to do?

• Request a change to existing documentation
• Add new documentation
• Report a technical problem with the documentation
• Other

Tell us about your request.
the config option http.detailed_errors.enabled can be used to control whether REST APIs return detailed error messages or just generic failures.
this should be documented, not just as a "there's this parameter" but also as a general security guideline (some security reviewers consider it prudent to reduce the amount of information returned by production systems in case of errors to prevent explorative behaviour of attackers).

IMHO it'd anyway be good to have a general "security best practices" chapter in the documentation, this would then fit in nicely there.

What other resources are available?

• this can be considered a sub-task of [DOC]Full documentation to opensearch.yml #214
• this behaviour was changed slightly in prevent inclusion of stack trace in response (leak of detailed error information) OpenSearch#4255, [BUG] generic "No OpenSearchException found" error if http.detailed_errors is disabled OpenSearch#4545, the developers involved there will be able to provide further input
• Added second paragraph to Stack traces option #1403 added some note about this to a related documentation but it seems that this isn't in the published version anymore?
• your security experts should be able to weigh in on the security considerations

[hdhalter]

We'll add this as a best practice in #5782.

[AntonEliatra]

@hdhalter this seems to already have been fixed in the PRs lister above, There is no further information leak, below is the current state.

http.detailed_errors.enabled: true (default)

"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"transient setting [http.detailed_errors.enabled], not dynamically updateable"}],"type":"illegal_argument_exception","reason":"transient setting [http.detailed_errors.enabled], not dynamically updateable"},"status":400

http.detailed_errors.enabled: false

"error":"RemoteTransportException[[opensearch-node2][172.31.0.2:9300][cluster:admin/settings/update]]","status":400

[hdhalter]

@AntonEliatra - The suggestion is to describe the setting in the documentation. Perhaps we can add to #7113?

[AntonEliatra]

@hdhalter PR raised for this, but I added it to a different section which seemed more appropriate
#7173