Accept the 500 body without the exception message in BuiltInEndpointsSpec - #2277
Merged
Conversation
…Spec Micronaut Framework 5.2 adds micronaut.server.error-response-include-message, which defaults to never, so the 500 response for a sensitive endpoint without a SensitiveEndpointRule replacement now carries only "Internal Server Error". The spec accepts that and the message form older cores render, and it now asserts the 500 status. See micronaut-projects/micronaut-core#13110 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 tasks
|
graemerocher
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of micronaut-projects/micronaut-core#13110 (moving projects onto core 5.2).
Problem
On core 5.2.0,
BuiltInEndpointsSpecfails every time on "test accessing a sensitive endpoint with authentication but no SensitiveEndpointRule replacement throws an exception":Core 5.2 added
micronaut.server.error-response-include-message(never|always|on-param) in micronaut-core 05421f2708. It defaults tonever, soRouteExecutornow renders a plainInternal Server Errorfor unhandled exceptions. The raw message stays inErrorContext.getExceptionMessage()and in the server log.Change
Test only. The spec now:
Internal Server Error(core 5.2 by default) orInternal Server Error: <message>(core 5.1).I did not set
micronaut.server.error-response-include-message: alwaysin the spec. That setting is not recommended for production, and this spec is included in the docs. So the test should show how security behaves under the default setting.SensitiveEndpointRulestill rejects the request the same way. No main code or docs in security depend on the exception message being in the 500 body. The hint forNON_REPLACED_SECURITY_ERROR_MESSAGEis still logged byRouteExecutor.Verification
BuiltInEndpointsSpecpasses before and after this change (2 tests). Full./gradlew check --continuewith this change: 1675 tests, 0 failures, 2 skipped.BuiltInEndpointsSpecfails before this change and passes after it (2 tests). Full./gradlew check --continuewith this change: 1675 tests, 0 failures, 2 skipped.Core version
This PR keeps
micronaut = "5.1.12", so it can merge on its own. 5.4.x is at5.4.0-SNAPSHOTand nov5.4.*is released, so the core 5.2 bump itself can also land on this branch in a separate PR. No new branch is needed.🤖 Generated with Claude Code