Add option to turn off error sanitization in production

[mjadczak]

Currently, when the server mode is not development, Remix removes the details of any errors being thrown before they are sent to the client: https://github.com/remix-run/remix/blob/main/packages/remix-server-runtime/errors.ts#L58
Further, as far as I can tell, this behaviour is not documented.

While it makes total sense to do this for most applications, I am working on an internal app accessible only on a corporate network, and while we're not worried about leaking internal details in the stack trace, displaying the full error details and stack trace if something goes really wrong makes it easier for us to diagnose issues the user is having.

I propose:

1. To document this behaviour and make it clear that the way errors are handled is different in development and production mode
2. To add a config option to disable the error sanitization altogether (while keeping the current default of only sanitizing in prod). Perhaps an "always sanitize" option would also make sense, for those who want the dev behaviour to match prod.

[brophdawg11]

FWIW this is documented here.

My recommendation with the current behavior would be to log a user session id along with the unsanitized errors in handleError and then if an issue occurs you should only need a rough time it happened and a user session id to find it in the server logs.

[mjadczak]

Thanks, good to know it's documented!

I agree that there are likely better ways to get at this (such as the one you suggested) but we have an internal application where seeing the error details can be useful even to users who aren't the app's developers.

Another typical usecase for this is a test deployment of the application, where you're likely running in "production" as far as npm is concerned (through the normal build system) but the deployment of the app is one for dev / testing purposes, just not a local machine.

We've been running with an npm patch in place to disable the sanitisation thus far, and this works fine.

[gustavopch]

I'd also benefit from this. I know I shouldn't expose error messages to users, but it's useful while I can't implement something better, so I'm currently patching the package in node_modules.

[armin-dioxycle]

I'm also considering patching the package - same use case.

[mjadczak]

If helpful, here's our very simple patch as of 2.12.1 (we use patch-package to apply it automatically and to update it when we upgrade Remix)

diff --git a/node_modules/@remix-run/server-runtime/dist/errors.js b/node_modules/@remix-run/server-runtime/dist/errors.js
index afbd5c5..3123dcd 100644
--- a/node_modules/@remix-run/server-runtime/dist/errors.js
+++ b/node_modules/@remix-run/server-runtime/dist/errors.js
@@ -58,7 +58,7 @@ var mode = require('./mode.js');
  */
 
 function sanitizeError(error, serverMode) {
-  if (error instanceof Error && serverMode !== mode.ServerMode.Development) {
+  if (false) {
     let sanitized = new Error("Unexpected Server Error");
     sanitized.stack = undefined;
     return sanitized;
diff --git a/node_modules/@remix-run/server-runtime/dist/esm/errors.js b/node_modules/@remix-run/server-runtime/dist/esm/errors.js
index 6b44348..c15ae6a 100644
--- a/node_modules/@remix-run/server-runtime/dist/esm/errors.js
+++ b/node_modules/@remix-run/server-runtime/dist/esm/errors.js
@@ -54,7 +54,7 @@ import { ServerMode } from './mode.js';
  */
 
 function sanitizeError(error, serverMode) {
-  if (error instanceof Error && serverMode !== ServerMode.Development) {
+  if (false) {
     let sanitized = new Error("Unexpected Server Error");
     sanitized.stack = undefined;
     return sanitized;

[armin-dioxycle]

Thanks, this is helpful!