python-restx / flask-restx

Fork of Flask-RESTPlus: Fully featured framework for fast, easy and documented API development with Flask

Home Page:https://flask-restx.readthedocs.io/en/latest/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

should RESTX_ERROR_404_HELP be disabled by default?

frankli0324 opened this issue · comments

commented

Ask a question

background:
I came through #550 and went to flask-restful/flask-restful#780, I see similar behaviors in both libraries. I use restx.
at least it seems to me that author to restful believes the option should never have been existed.

I believe that RESTX_ERROR_404_HELP should at least be disabled by default because:

  • it causes confusion. I spent some time finding who's responsible for the extra error message.
  • there could be security concerns. it could help attackers enumerate the routes.

I'm interested to see other people's opinion on if this is a big issue for them?

I'm always a little bit weary of making any changes to the defaults because they cause breaking changes for user's upgrading versions.