title: nestjs / graphql : default exception filter discloses too much sensitive data
body: <p>The docs at <a href="https://docs.nestjs.com/graphql/other-features#exception-filters" rel="nofollow noreferrer">https://docs.nestjs.com/graphql/other-features#exception-filters</a> only says :</p>
  <blockquote>
  <p>Nest standard exception filters are compatible with GraphQL applications as well. As with ExecutionContext, GraphQL apps should transform the ArgumentsHost object to a GqlArgumentsHost object.</p>
  </blockquote>
  <p>In the &quot;default&quot; doc at <a href="https://docs.nestjs.com/exception-filters" rel="nofollow noreferrer">https://docs.nestjs.com/exception-filters</a>, we see</p>
  <blockquote>
  <p>the built-in exception filter generates the following default JSON response:</p>
  </blockquote>
  <p>followed by a very simple JSON</p>
  <p>however, when I execute a route that does throw an error (Db not available), here is the output I have :</p>
  <pre><code>{
    &quot;errors&quot;: [
      {
        &quot;message&quot;: &quot;connect ECONNREFUSED 127.0.0.1:5432&quot;,
        &quot;locations&quot;: [
          {
            &quot;line&quot;: 2,
            &quot;column&quot;: 3
          }
        ],
        &quot;path&quot;: [
          &quot;createMessage&quot;
        ],
        &quot;extensions&quot;: {
          &quot;code&quot;: &quot;INTERNAL_SERVER_ERROR&quot;,
          &quot;exception&quot;: {
            &quot;errno&quot;: -61,
            &quot;code&quot;: &quot;ECONNREFUSED&quot;,
            &quot;syscall&quot;: &quot;connect&quot;,
            &quot;address&quot;: &quot;127.0.0.1&quot;,
            &quot;port&quot;: 5432
          }
        }
      }
    ],
    &quot;data&quot;: null
  }
  </code></pre>
  <p>As you can see, lots of sensitive data are sent to the client (instead of the simple &quot;Internal server error&quot; mentionned in the docs)</p>
  <p>Note that I configured (temporarily) NODE_ENV=production</p>
  <p>Also note that my codebase does not contain any <code>@Catch</code> so I assume that I am using the default behavior</p>
  <p>Can someone explains what is happening here ? Is the default exception filter not active by default in graphql ?</p>