Server error data should NOT be sent to the client

[kevmoo]

Currently at d71e331

There seems to be logic that sends a toString() or similar of unknown exceptions to the client.

This should be FORBIDDEN. Unless the developer throws a specific error intended to be used as an HTTP exception, a blank 500 should be sent to the user.

In these cases, a LOG should be printed about the unexpected error type.

I wonder if some of this might be helpful

https://pub.dev/documentation/google_cloud/latest/google_cloud/createLoggingMiddleware.html

https://github.com/GoogleCloudPlatform/functions-framework-dart/blob/main/google_cloud/lib/src/logging.dart

[Ehesp]

@kevmoo I may be misunderstanding, but the admin sdks are supposed to be only used on server/io environments - bubbling the server error to the client (bad) is more of a functions sdk (https onRequest/onCall) issue we need to make sure doesn't happen?

[Ehesp]

This needs sorting on the functions sdk though, made an issue: firebase/firebase-functions-dart#29