Context Without Leaking Detail

## Why this happens at all Go's error chain is text. `fmt.Errorf("load user %d: %w", id, err)` builds a value whose `Error()` returns its own prefix, a separator, and then the wrapped error's `Error()`. Recursively, that means one flat string containing every layer's contribution *and* the database driver's own message — which commonly includes the statement it was running, the host it was dialling, or a full connection string. Nothing in the language marks part of that string as internal. So `http.Error(w, err.Error(), http.StatusInternalServerError)` is not a small mistake; it is a pipe from your storage layer straight to a customer's browser. A second Go-specific factor makes it worse: because errors carry no stack trace, teams stuff diagnostics into the message text. The more diligent the wrapping culture, the more there is to leak. ## Fix the boundary, not the messages The tempting fix is to go through the codebase removing sensitive substrings, or to trim the message before writing it. Both are wrong: - **Trimming is parsing your own prose.** `strings.SplitN(err.Error(), ": ", 2)` breaks the moment a layer rewords its prefix, and the driver's text has no fixed shape to cut at. - **Auditing every message** is unbounded work that regresses with every new wrap site and every dependency upgrade. The robust fix is structural: **there is exactly one function in the service that turns an error into a response, and it never calls `err.Error()` for the caller.** Two audiences, two outputs: - **Operators** get the full chain, logged once, at the boundary, with a request/correlation id and any structured fields worth having. - **Callers** get a fixed message plus that same correlation id, so support can join the two without the caller ever seeing internals. ```go func writeError(w http.ResponseWriter, r *http.Request, reqID string, err error) { slog.ErrorContext(r.Context(), "request failed", "req_id", reqID, "err", err) http.Error(w, "could not complete request (ref "+reqID+")", http.StatusInternalServerError) } ``` Once that exists, the review rule is a one-liner: handlers call `writeError`, handlers never call `http.Error` with error text. ## When a caller does need specific wording Some failures should say something useful — "user 42 not found", "quantity must be positive". Do not derive that from the chain; carry it explicitly. A small type gives you a public message and an internal cause in one value: ```go type SafeError struct { Public string Cause error } func (e *SafeError) Error() string { return e.Public + ": " + e.Cause.Error() } func (e *SafeError) Unwrap() error { return e.Cause } ``` At the boundary, `errors.As(err, &se)` decides whether there is public wording to render; everything else falls back to the fixed message. Two details matter here. First, `Error()` deliberately keeps the full chain, because that is the operator view — if you make `Error()` return only `Public`, the cause silently disappears from every log line that formats the error, and you have traded a disclosure bug for a blindness bug. Second, the public text is a **constant-shaped** message: interpolate only values the caller supplied, never anything you resolved internally. ## Prove it, then keep proving it This is a class of bug that returns, so pin it with a test rather than a memory. Drive the handler with a forced storage failure — an injected error, or a closed database — capture the response body, and assert on the body itself: it contains the fixed message and the id, and it does **not** contain the query text, the host name, or the driver's marker words. Asserting on the captured body rather than on the helper's internals is what makes the test survive refactors, and it is the artefact a security reviewer can actually read. ## Two patterns to reject - **Verbose errors gated by environment.** "Detailed in staging, terse in production" means the code path that ships is the one nobody exercises, and one bad config promotes the leak. Same path everywhere; detail goes to the log. - **Sanitising in middleware by string matching.** A recovery or logging middleware that greps the message for secrets inherits every weakness of trimming, and it silently fails on the next driver's wording. ## What good looks like afterwards A customer sees `could not complete request (ref 01J8Z...)`. An operator searches that id and finds one log line with the full chain: `render profile page: query user 42: <driver text>`. The repository still wraps richly, the service still adds its use case, and none of it crosses the boundary, because crossing is now a decision made in one function that a reviewer can read in ten seconds.