Handle unexpected exceptions once near the HTTP boundary, log the full server-side error with a correlation/trace ID, and return a safe RFC 7807 Problem Details response. Map expected domain outcomes explicitly rather than throwing for normal control flow. Example: builder.Services.AddProblemDetails(); app.UseExceptionHandler(); Return stable status/type/title fields and validation errors, but never stack traces, SQL, secrets, or internal host names. Distinguish 400 validation, 401 authentication, 403 authorization, 404 absence, 409 conflicts, and 500 unexpected failures. Preserve cancellation semantics, avoid catching exceptions only to rethrow incorrectly, and add tests confirming production responses do not leak sensitive details.
Backbencher Developer · · 0 likes