Why not send stack traces in production?
Stack traces expose internal file paths, library versions, and logic. Attackers can use them to find weaknesses. In production, send a safe message; log the full error internally. Use an expose flag on ApiError for safe-to-show errors.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Express Error-Handling Middleware Explained
It has four parameters (err, req, res, next). Express detects this arity and uses it for errors. Register it last. In handlers, throw or call next(err). Express then jumps to the error handler.
Use an asyncHandler wrapper: Promise.resolve(fn(req, res, next)).catch(next). This catches promise rejections and passes them to the error handler. Express 5 catches async errors automatically.
A subclass of Error with a status and message. Use it to throw new ApiError(404, 'User not found'). The error handler reads err.status and err.message, so errors are consistent and typed.
Still have questions?
Browse all our FAQs or reach out to our support team