Prevent session errors from swallowing API error responses#2059
Open
kayjoosten wants to merge 1 commit into
Open
Prevent session errors from swallowing API error responses#2059kayjoosten wants to merge 1 commit into
kayjoosten wants to merge 1 commit into
Conversation
Why is this change needed? Prior to this change, ErrorReporter::reportError() only wrapped its call to storeSessionFeedback() in a finally block, not a catch. On stateless routes (e.g. the /api/connections metadata push endpoint), starting the native PHP session while storing feedback info can fail (e.g. "headers already sent"). That failure propagated out of reportError(), out of the calling exception listener, and skipped $event->setResponse() in ApiHttpExceptionListener — so the intended 400/500 JSON error response for a failed push was never set and the client received an HTTP 200 instead. How does it address the issue? This change adds a catch (Throwable) around storeSessionFeedback(), logging the secondary failure as a warning instead of letting it escape. reportError() can no longer throw, so every exception listener that calls it (API, feedback page, fallback) reliably finishes and sets its intended error response. #2051
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ApiHttpExceptionListener::onKernelException()callsErrorReporter::reportError()before$event->setResponse(...).reportError()only wrapped its session-feedback write in afinally, not acatch— so on stateless routes (e.g./api/connectionsmetadata push), a session-start failure (e.g. "headers already sent") propagated out, skippedsetResponse(), and the client got HTTP 200 instead of the intended 400/500.ThrowablearoundstoreSessionFeedback()inErrorReporter::reportError(), log it as a warning, and let the caller always finish. This applies to every exception listener that usesreportError()(API, feedback page, fallback), not just the push endpoint.Test plan
phpunit --testsuite=unit --filter ErrorReporterTest(new regression test added)phpunit --testsuite=eb4/unit/integration/functional— all passphpcs,phpmd,docheader— cleanlint:twig,phpcs-legacy,yarn lint— cleanCloses #2051