Hiding the stacktrace for an exception returned by a asp.net WebMethod?

Question

I am using methods with the Attribute [WebMethod] in my aspx pages. I don't use any asp.net ajax but jQuery to call these methods and return objects in JSON. This all works fine.

Next I added an authorization check inside the webMethod, if the current user doesn't have access to the feature I need to let the calling JavaScript know.

So I am throwing an AccessViolationException exception which can then be parsed by the OnError callback function in JavaScript. This works too but the exception includes the full StackTrace and I don't want to make this available to the calling client.

What other ways I could use to return an "Access Denied" to the client when the WebMethod returns a business object?

I'm using ASP.Net 3.5SP1 and jQuery 1.32

Answer 1

Why propagate errors through the wire? why not use an error response ?

Just wrap your object in a response object wich can contain an error code for status and an error message to present to users.

Answer 2

I save exceptions for when things go really wrong. (e.g. can't connect to the database)

Either return nothing (null/nill/whatever), or return a false bool value.

Sorry that I don't have a better answer than that...I'll have to keep looking myself.

Answer 3

You could look at SoapException: http://msdn.microsoft.com/en-us/library/system.web.services.protocols.soapexception(VS.71).aspx

I'm just not sure, if it will work when it is called from JavaScript. Espeially if it's called with a get-request.

BTW AccessViolationException is to my best knowlegde ment to be thrown when the application is accessing memory it has no access to.

/Asger

Answer 4

As suggested by NunFur I changed my approach and rather than throwing an error, I return a 'richer' object.

There are at least two options, the first one would be to encapsulate my business object into a response object with some status properties. I tried this but it makes the JSON more complicated. So rather than adding a new object I added two properties to my business object, something like ServiceStatus and ServiceMessage. By default these are 200 and '', but can be set by the WebMethod code if anything goes wrong (no access, proper error). In this case they business object will be 'empty' (no data). The JavaScript code then first checks for the ServiceStatus and reacts appropriately.

I add the two fields to all my objects that are returned by WebMethods, even a simple string. They have to implement an Interface with those two properties.

Now I have complete control over that goes over the wire in case something unexpected is happening.

Thanks for the input