should RESTX_ERROR_404_HELP be disabled by default?
frankli0324 opened this issue · comments
Ask a question
background:
I came through #550 and went to flask-restful/flask-restful#780, I see similar behaviors in both libraries. I use restx.
at least it seems to me that author to restful believes the option should never have been existed.
I believe that RESTX_ERROR_404_HELP should at least be disabled by default because:
- it causes confusion. I spent some time finding who's responsible for the extra error message.
- there could be security concerns. it could help attackers enumerate the routes.
I'm interested to see other people's opinion on if this is a big issue for them?
I'm always a little bit weary of making any changes to the defaults because they cause breaking changes for user's upgrading versions.