onConnect error message does not go to client

[mattkrick]

The onConnect handler says throwing an error propagates that message to the client:

graphql-ws/src/server.ts

Lines 214 to 217 in 5161bd9

	* Throwing an error from within this function will
	* close the socket with the `Error` message
	* in the close event reason.
	*/

However, this isn't true in production:

graphql-ws/src/use/uWebSockets.ts

Lines 206 to 207 in 5161bd9

	isProd
	? 'Internal server error'

So if the client handles things differently based off that message, it'll work great in development, but break in production 😬 .

Looks like the reason was to limit the size of the message, which is understandable, but chances are most messages will still be < 1 MTU so it shouldn't make any real difference. Would it be possible to send the message to the client so the code works in prod just like it does in dev?

[enisdenjo]

Hey, sure it would possible, but not masking the message in prod goes against security conventions and could pose a security flaw.

I see two options:

1. Not set node_env to production
2. Accept an argument in makeBehaviour where you pass a "isProd" or "maskInternalError" flag

What do you think?

[mattkrick]

I like the error masking! IMO it's a more expressive solution than spoofing the environment.

it could default to true & accept either a false or a custom handling function. That would match roughly the same signature as graphql-yoga https://the-guild.dev/graphql/yoga-server/docs/features/error-masking#customize-error-masking

[enisdenjo]

Cool, that makes sense! Would you like to try and tackle it in a PR? 😄

[mattkrick]

sure thing! i owe you a PR on #634 as well, I won't forget, just need to wrap up a sprint first.