Exception message not included in response when throwing ResponseStatusException in Spring Boot

Question

My Spring Boot application provides the following REST controller:

@RestController @RequestMapping("/api/verify") public class VerificationController {      final VerificationService verificationService;      Logger logger = LoggerFactory.getLogger(VerificationController.class);      public VerificationController(VerificationService verificationService) {         this.verificationService = verificationService;     }      @GetMapping     public void verify(             @RequestParam(value = "s1") String s1,             @RequestParam(value = "s2") String s2) {              try {             verificationService.validateFormat(s1, s2);         } catch (InvalidFormatException e) {             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());         }     } } 

In case validateFormat() throws the InvalidFormatException the client gets a HTTP 400 which is correct. The default JSON response body however looks like this:

{     "timestamp": "2020-06-18T21:31:34.911+00:00",     "status": 400,     "error": "Bad Request",     "message": "",     "path": "/api/verify" } 

The message value is always empty even if I hard-code it like this:

throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "some string"); 

This is the exception class:

public class InvalidFormatException extends RuntimeException {      public InvalidFormatException(String s1, String s2) {         super(String.format("Invalid format: [s1: %s, s2: %s]", s1, s2));     } } 

Answer 1

This behavior has changed with Spring Boot 2.3 and is intentional. See release notes for details.

Setting server.error.include-message=always in the application.properties resolves this issue.

Answer 2

Setting server.error.include-message=always disclosures messages of internal exceptions and this might be a problem in production environment.

An alternative approach is to use ExceptionHandler. Here you can control what is transferred to client:

@ControllerAdvice public class GlobalExceptionHandler {     @ExceptionHandler(ResponseStatusException.class)     public ResponseEntity<String> handleBadRequestException(ResponseStatusException ex) {         // if you want you can do some extra processing with message and status of an exception          // or you can return it without any processing like this:         return new ResponseEntity<>(ex.getMessage(), ex.getStatus());     } }