[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6},"actionData","errors","routes/blog-tag",{"_7":8,"_9":10},"tag",{"_31":87,"_72":88,"_35":89},"articles",{"_11":12,"_13":14,"_15":16,"_17":16,"_18":19,"_20":21,"_22":23,"_24":23,"_25":16,"_26":27},"content",[30],"pageable",{"_28":21,"_29":19},"totalElements",1,"totalPages","size",10,"number",0,"first",true,"last","numberOfElements","empty",false,"page_number","page_size",{"_31":32,"_33":34,"_35":36,"_37":38,"_11":39,"_40":-5,"_41":23,"_42":27,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":52,"_54":55,"_56":57,"_58":59,"_60":52,"_61":16,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71},"id",17,"title","Global Error Handling","slug","clean-code-part-16-global-error-handling","excerpt","Implement RFC 7807 Problem Details standard for consistent, machine-readable API error responses across your Spring Boot application.","# Advanced Clean Code Patterns Part 16: Global Error Handling & RFC 7807\n\nConsistent error responses are crucial for API usability. This article covers implementing RFC 7807 Problem Details, building a global exception handler, and creating a unified error handling strategy across your application.\n\n## 📋 At a Glance\n\n| Aspect | Details |\n|--------|---------|\n| Standard | RFC 7807 Problem Details for HTTP APIs |\n| Spring Support | ProblemDetail (Spring 6+), @ControllerAdvice |\n| Content-Type | application/problem+json |\n| Benefits | Consistent errors, machine-readable, self-documenting |\n\n---\n\n## 🎯 What You'll Learn\n\n- **RFC 7807 Problem Details** standard\n- **Spring Boot 3** native support\n- **Global exception handler** implementation\n- **Error mapping** strategies\n- **Logging and monitoring** integration\n\n---\n\n## Production Story: The Inconsistent API\n\nAn API had inconsistent error responses across endpoints:\n\n```json\n// Endpoint A - string message\n{ \"error\": \"User not found\" }\n\n// Endpoint B - code and message\n{ \"code\": 404, \"message\": \"Not found\" }\n\n// Endpoint C - nested errors\n{ \"errors\": { \"field\": \"email\", \"msg\": \"Invalid\" } }\n\n// Endpoint D - just status\n{ \"status\": \"FAILED\" }\n```\n\n**Problems:**\n- Frontend needed different parsing for each endpoint\n- No way to programmatically identify error type\n- Documentation was a nightmare\n- Third-party integrations constantly broke\n\n**The fix:** RFC 7807 everywhere:\n\n```json\n{\n \"type\": \"https://api.example.com/errors/user-not-found\",\n \"title\": \"User Not Found\",\n \"status\": 404,\n \"detail\": \"User with ID 12345 was not found\",\n \"instance\": \"/api/users/12345\",\n \"traceId\": \"abc123\"\n}\n```\n\n---\n\n## Mental Model: RFC 7807 Structure\n\n```text\n┌─────────────────────────────────────────────────────────────────┐\n│ RFC 7807 PROBLEM DETAILS │\n├─────────────────────────────────────────────────────────────────┤\n│ │\n│ REQUIRED FIELDS │\n│ ┌────────────────────────────────────────────────────────────┐ │\n│ │ │ │\n│ │ type: URI identifying the problem type │ │\n│ │ (default: \"about:blank\") │ │\n│ │ │ │\n│ │ title: Short, human-readable summary │ │\n│ │ (same for all instances of this type) │ │\n│ │ │ │\n│ │ status: HTTP status code (e.g., 404, 400, 500) │ │\n│ │ │ │\n│ └────────────────────────────────────────────────────────────┘ │\n│ │\n│ OPTIONAL FIELDS │\n│ ┌────────────────────────────────────────────────────────────┐ │\n│ │ │ │\n│ │ detail: Human-readable explanation specific │ │\n│ │ to THIS occurrence │ │\n│ │ │ │\n│ │ instance: URI reference identifying THIS occurrence │ │\n│ │ (usually the request path) │ │\n│ │ │ │\n│ └────────────────────────────────────────────────────────────┘ │\n│ │\n│ EXTENSION FIELDS (custom) │\n│ ┌────────────────────────────────────────────────────────────┐ │\n│ │ traceId, errorCode, timestamp, errors[], etc. │ │\n│ └────────────────────────────────────────────────────────────┘ │\n│ │\n└─────────────────────────────────────────────────────────────────┘\n```\n\n---\n\n## 🔬 Deep Dive\n\n### Pattern 1: Spring 6+ Native ProblemDetail\n\n```java\n// ✅ Using Spring's built-in ProblemDetail (Spring 6+/Boot 3+)\n\n@RestControllerAdvice\npublic class GlobalExceptionHandler extends ResponseEntityExceptionHandler {\n\n private static final String ERROR_BASE_URI = \"https://api.example.com/errors/\";\n\n @ExceptionHandler(ResourceNotFoundException.class)\n public ProblemDetail handleNotFound(ResourceNotFoundException ex,\n HttpServletRequest request) {\n ProblemDetail problem = ProblemDetail.forStatusAndDetail(\n HttpStatus.NOT_FOUND,\n ex.getMessage()\n );\n problem.setType(URI.create(ERROR_BASE_URI + \"resource-not-found\"));\n problem.setTitle(\"Resource Not Found\");\n problem.setInstance(URI.create(request.getRequestURI()));\n\n // Extension properties\n problem.setProperty(\"resourceType\", ex.getResourceType());\n problem.setProperty(\"resourceId\", ex.getResourceId());\n problem.setProperty(\"traceId\", MDC.get(\"traceId\"));\n problem.setProperty(\"timestamp\", Instant.now());\n\n return problem;\n }\n\n @ExceptionHandler(ValidationException.class)\n public ProblemDetail handleValidation(ValidationException ex,\n HttpServletRequest request) {\n ProblemDetail problem = ProblemDetail.forStatusAndDetail(\n HttpStatus.BAD_REQUEST,\n \"Validation failed\"\n );\n problem.setType(URI.create(ERROR_BASE_URI + \"validation-error\"));\n problem.setTitle(\"Validation Error\");\n problem.setInstance(URI.create(request.getRequestURI()));\n\n // Add validation errors as extension\n problem.setProperty(\"errors\", ex.getErrors().stream()\n .map(e -> Map.of(\n \"field\", e.field(),\n \"message\", e.message(),\n \"rejectedValue\", e.rejectedValue()\n ))\n .toList());\n\n return problem;\n }\n\n @ExceptionHandler(Exception.class)\n public ProblemDetail handleGeneric(Exception ex, HttpServletRequest request) {\n log.error(\"Unexpected error\", ex);\n\n ProblemDetail problem = ProblemDetail.forStatusAndDetail(\n HttpStatus.INTERNAL_SERVER_ERROR,\n \"An unexpected error occurred\"\n );\n problem.setType(URI.create(ERROR_BASE_URI + \"internal-error\"));\n problem.setTitle(\"Internal Server Error\");\n problem.setInstance(URI.create(request.getRequestURI()));\n problem.setProperty(\"traceId\", MDC.get(\"traceId\"));\n\n return problem;\n }\n}\n```\n\n---\n\n### Pattern 2: Custom Problem Detail with Builder\n\n```java\n// ✅ Custom Problem Detail for more control\n\npublic class ApiProblem {\n private URI type;\n private String title;\n private int status;\n private String detail;\n private URI instance;\n private Instant timestamp;\n private String traceId;\n private Map extensions;\n\n private ApiProblem(Builder builder) {\n this.type = builder.type;\n this.title = builder.title;\n this.status = builder.status;\n this.detail = builder.detail;\n this.instance = builder.instance;\n this.timestamp = Instant.now();\n this.traceId = MDC.get(\"traceId\");\n this.extensions = builder.extensions;\n }\n\n public static Builder builder() {\n return new Builder();\n }\n\n // Getters...\n\n public static class Builder {\n private URI type = URI.create(\"about:blank\");\n private String title;\n private int status;\n private String detail;\n private URI instance;\n private Map extensions = new HashMap<>();\n\n public Builder type(String type) {\n this.type = URI.create(type);\n return this;\n }\n\n public Builder title(String title) {\n this.title = title;\n return this;\n }\n\n public Builder status(HttpStatus status) {\n this.status = status.value();\n return this;\n }\n\n public Builder status(int status) {\n this.status = status;\n return this;\n }\n\n public Builder detail(String detail) {\n this.detail = detail;\n return this;\n }\n\n public Builder instance(String path) {\n this.instance = URI.create(path);\n return this;\n }\n\n public Builder extension(String key, Object value) {\n this.extensions.put(key, value);\n return this;\n }\n\n public Builder errors(List errors) {\n this.extensions.put(\"errors\", errors);\n return this;\n }\n\n public ApiProblem build() {\n return new ApiProblem(this);\n }\n }\n}\n\n// Pre-defined problem types\npublic class ProblemTypes {\n private static final String BASE = \"https://api.example.com/errors/\";\n\n public static final String VALIDATION_ERROR = BASE + \"validation-error\";\n public static final String NOT_FOUND = BASE + \"not-found\";\n public static final String CONFLICT = BASE + \"conflict\";\n public static final String UNAUTHORIZED = BASE + \"unauthorized\";\n public static final String FORBIDDEN = BASE + \"forbidden\";\n public static final String RATE_LIMITED = BASE + \"rate-limited\";\n public static final String INTERNAL_ERROR = BASE + \"internal-error\";\n}\n```\n\n---\n\n### Pattern 3: Comprehensive Exception Handler\n\n```java\n// ✅ Full-featured exception handler\n\n@RestControllerAdvice\n@Slf4j\npublic class GlobalExceptionHandler {\n\n private final MessageSource messageSource;\n\n public GlobalExceptionHandler(MessageSource messageSource) {\n this.messageSource = messageSource;\n }\n\n // Business exceptions\n @ExceptionHandler(BusinessException.class)\n public ResponseEntity handleBusinessException(\n BusinessException ex, HttpServletRequest request) {\n\n log.warn(\"Business exception: {} - {}\", ex.getErrorCode(), ex.getMessage());\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.BASE + ex.getErrorCode().toLowerCase())\n .title(resolveTitle(ex.getErrorCode()))\n .status(ex.getHttpStatus())\n .detail(ex.getMessage())\n .instance(request.getRequestURI())\n .extension(\"errorCode\", ex.getErrorCode())\n .build();\n\n return ResponseEntity.status(ex.getHttpStatus()).body(problem);\n }\n\n // Validation - Spring @Valid\n @ExceptionHandler(MethodArgumentNotValidException.class)\n public ResponseEntity handleValidation(\n MethodArgumentNotValidException ex, HttpServletRequest request) {\n\n List> errors = ex.getBindingResult()\n .getFieldErrors()\n .stream()\n .map(fe -> Map.of(\n \"field\", fe.getField(),\n \"message\", fe.getDefaultMessage(),\n \"rejectedValue\", fe.getRejectedValue() != null ?\n fe.getRejectedValue().toString() : \"null\"\n ))\n .toList();\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.VALIDATION_ERROR)\n .title(\"Validation Failed\")\n .status(HttpStatus.BAD_REQUEST)\n .detail(String.format(\"%d validation error(s)\", errors.size()))\n .instance(request.getRequestURI())\n .extension(\"errors\", errors)\n .build();\n\n return ResponseEntity.badRequest().body(problem);\n }\n\n // Constraint violations (path variables, query params)\n @ExceptionHandler(ConstraintViolationException.class)\n public ResponseEntity handleConstraintViolation(\n ConstraintViolationException ex, HttpServletRequest request) {\n\n List> errors = ex.getConstraintViolations()\n .stream()\n .map(cv -> Map.of(\n \"field\", extractFieldName(cv.getPropertyPath()),\n \"message\", cv.getMessage()\n ))\n .toList();\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.VALIDATION_ERROR)\n .title(\"Constraint Violation\")\n .status(HttpStatus.BAD_REQUEST)\n .detail(\"Request parameters failed validation\")\n .instance(request.getRequestURI())\n .extension(\"errors\", errors)\n .build();\n\n return ResponseEntity.badRequest().body(problem);\n }\n\n // Authentication\n @ExceptionHandler(AuthenticationException.class)\n public ResponseEntity handleAuthentication(\n AuthenticationException ex, HttpServletRequest request) {\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.UNAUTHORIZED)\n .title(\"Unauthorized\")\n .status(HttpStatus.UNAUTHORIZED)\n .detail(\"Authentication required\")\n .instance(request.getRequestURI())\n .build();\n\n return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(problem);\n }\n\n // Authorization\n @ExceptionHandler(AccessDeniedException.class)\n public ResponseEntity handleAccessDenied(\n AccessDeniedException ex, HttpServletRequest request) {\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.FORBIDDEN)\n .title(\"Forbidden\")\n .status(HttpStatus.FORBIDDEN)\n .detail(\"You don't have permission to access this resource\")\n .instance(request.getRequestURI())\n .build();\n\n return ResponseEntity.status(HttpStatus.FORBIDDEN).body(problem);\n }\n\n // Rate limiting\n @ExceptionHandler(RateLimitExceededException.class)\n public ResponseEntity handleRateLimit(\n RateLimitExceededException ex, HttpServletRequest request) {\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.RATE_LIMITED)\n .title(\"Rate Limit Exceeded\")\n .status(HttpStatus.TOO_MANY_REQUESTS)\n .detail(\"You have exceeded the rate limit\")\n .instance(request.getRequestURI())\n .extension(\"retryAfter\", ex.getRetryAfterSeconds())\n .build();\n\n return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)\n .header(\"Retry-After\", String.valueOf(ex.getRetryAfterSeconds()))\n .body(problem);\n }\n\n // Catch-all for unexpected errors\n @ExceptionHandler(Exception.class)\n public ResponseEntity handleUnexpected(\n Exception ex, HttpServletRequest request) {\n\n String traceId = MDC.get(\"traceId\");\n log.error(\"Unexpected error [traceId={}]\", traceId, ex);\n\n ApiProblem problem = ApiProblem.builder()\n .type(ProblemTypes.INTERNAL_ERROR)\n .title(\"Internal Server Error\")\n .status(HttpStatus.INTERNAL_SERVER_ERROR)\n .detail(\"An unexpected error occurred. Please try again later.\")\n .instance(request.getRequestURI())\n .extension(\"traceId\", traceId)\n .build();\n\n return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(problem);\n }\n\n private String resolveTitle(String errorCode) {\n try {\n return messageSource.getMessage(\n \"error.\" + errorCode.toLowerCase() + \".title\",\n null, Locale.getDefault());\n } catch (NoSuchMessageException e) {\n return errorCode.replace(\"_\", \" \");\n }\n }\n\n private String extractFieldName(Path path) {\n String fullPath = path.toString();\n int lastDot = fullPath.lastIndexOf('.');\n return lastDot >= 0 ? fullPath.substring(lastDot + 1) : fullPath;\n }\n}\n```\n\n---\n\n### Pattern 4: Error Catalog\n\n```java\n// ✅ Centralized error definitions\n\npublic enum ErrorCatalog {\n // Validation errors (400)\n VALIDATION_FAILED(\"VALIDATION_001\", \"Validation Failed\", HttpStatus.BAD_REQUEST),\n INVALID_FORMAT(\"VALIDATION_002\", \"Invalid Format\", HttpStatus.BAD_REQUEST),\n MISSING_REQUIRED_FIELD(\"VALIDATION_003\", \"Missing Required Field\", HttpStatus.BAD_REQUEST),\n\n // Authentication (401)\n INVALID_CREDENTIALS(\"AUTH_001\", \"Invalid Credentials\", HttpStatus.UNAUTHORIZED),\n TOKEN_EXPIRED(\"AUTH_002\", \"Token Expired\", HttpStatus.UNAUTHORIZED),\n TOKEN_INVALID(\"AUTH_003\", \"Invalid Token\", HttpStatus.UNAUTHORIZED),\n\n // Authorization (403)\n ACCESS_DENIED(\"AUTHZ_001\", \"Access Denied\", HttpStatus.FORBIDDEN),\n INSUFFICIENT_PERMISSIONS(\"AUTHZ_002\", \"Insufficient Permissions\", HttpStatus.FORBIDDEN),\n\n // Not found (404)\n USER_NOT_FOUND(\"USER_001\", \"User Not Found\", HttpStatus.NOT_FOUND),\n ORDER_NOT_FOUND(\"ORDER_001\", \"Order Not Found\", HttpStatus.NOT_FOUND),\n PRODUCT_NOT_FOUND(\"PRODUCT_001\", \"Product Not Found\", HttpStatus.NOT_FOUND),\n\n // Conflict (409)\n DUPLICATE_ENTITY(\"CONFLICT_001\", \"Duplicate Entity\", HttpStatus.CONFLICT),\n OPTIMISTIC_LOCK(\"CONFLICT_002\", \"Resource Modified\", HttpStatus.CONFLICT),\n\n // Business rules (422)\n INSUFFICIENT_FUNDS(\"BIZ_001\", \"Insufficient Funds\", HttpStatus.UNPROCESSABLE_ENTITY),\n ORDER_NOT_CANCELLABLE(\"BIZ_002\", \"Order Cannot Be Cancelled\", HttpStatus.UNPROCESSABLE_ENTITY),\n\n // Server errors (500)\n INTERNAL_ERROR(\"SERVER_001\", \"Internal Error\", HttpStatus.INTERNAL_SERVER_ERROR),\n SERVICE_UNAVAILABLE(\"SERVER_002\", \"Service Unavailable\", HttpStatus.SERVICE_UNAVAILABLE);\n\n private final String code;\n private final String title;\n private final HttpStatus status;\n\n ErrorCatalog(String code, String title, HttpStatus status) {\n this.code = code;\n this.title = title;\n this.status = status;\n }\n\n public ApiProblem toProblem(String detail, String instance) {\n return ApiProblem.builder()\n .type(ProblemTypes.BASE + code.toLowerCase().replace(\"_\", \"-\"))\n .title(title)\n .status(status)\n .detail(detail)\n .instance(instance)\n .extension(\"errorCode\", code)\n .build();\n }\n\n // Getters...\n}\n\n// Usage in handler\n@ExceptionHandler(InsufficientFundsException.class)\npublic ResponseEntity handleInsufficientFunds(\n InsufficientFundsException ex, HttpServletRequest request) {\n\n ApiProblem problem = ErrorCatalog.INSUFFICIENT_FUNDS.toProblem(\n String.format(\"Required: %s, Available: %s\", ex.getRequired(), ex.getAvailable()),\n request.getRequestURI()\n );\n\n return ResponseEntity.status(problem.getStatus()).body(problem);\n}\n```\n\n---\n\n### Pattern 5: Logging and Monitoring\n\n```java\n// ✅ Enhanced error logging with metrics\n\n@RestControllerAdvice\n@Slf4j\npublic class GlobalExceptionHandler {\n\n private final MeterRegistry meterRegistry;\n\n @ExceptionHandler(Exception.class)\n public ResponseEntity handleException(\n Exception ex, HttpServletRequest request) {\n\n String errorType = ex.getClass().getSimpleName();\n String path = request.getRequestURI();\n String method = request.getMethod();\n\n // Structured logging\n log.error(\"API Error: type={}, path={}, method={}, traceId={}\",\n errorType, path, method, MDC.get(\"traceId\"), ex);\n\n // Metrics\n meterRegistry.counter(\"api.errors\",\n \"type\", errorType,\n \"path\", sanitizePath(path),\n \"status\", String.valueOf(determineStatus(ex).value())\n ).increment();\n\n ApiProblem problem = buildProblem(ex, request);\n return ResponseEntity.status(problem.getStatus()).body(problem);\n }\n\n private String sanitizePath(String path) {\n // Replace IDs with placeholders for metric cardinality\n return path.replaceAll(\"/\\\\d+\", \"/{id}\")\n .replaceAll(\"/[a-f0-9-]{36}\", \"/{uuid}\");\n }\n}\n\n// ✅ Aspect for automatic error context\n@Aspect\n@Component\npublic class ErrorContextAspect {\n\n @Around(\"@within(RestController)\")\n public Object addErrorContext(ProceedingJoinPoint pjp) throws Throwable {\n try {\n return pjp.proceed();\n } catch (Exception ex) {\n // Add context to exception\n if (ex instanceof ApplicationException appEx) {\n appEx.addContext(\"controller\", pjp.getTarget().getClass().getSimpleName());\n appEx.addContext(\"method\", pjp.getSignature().getName());\n }\n throw ex;\n }\n }\n}\n```\n\n---\n\n### Pattern 6: Client-Side Error Handling\n\n```java\n// ✅ Error handling in API client\n\npublic class ApiClient {\n private final RestClient restClient;\n private final ObjectMapper objectMapper;\n\n public T get(String path, Class responseType) {\n return restClient.get()\n .uri(path)\n .retrieve()\n .onStatus(HttpStatusCode::isError, this::handleError)\n .body(responseType);\n }\n\n private void handleError(ClientHttpResponse response) throws IOException {\n ApiProblem problem = objectMapper.readValue(\n response.getBody(), ApiProblem.class);\n\n throw switch (response.getStatusCode().value()) {\n case 400 -> new ClientValidationException(problem);\n case 401 -> new ClientAuthenticationException(problem);\n case 403 -> new ClientAuthorizationException(problem);\n case 404 -> new ClientNotFoundException(problem);\n case 429 -> new ClientRateLimitException(problem);\n default -> new ClientApiException(problem);\n };\n }\n}\n\n// Exception with problem details\npublic class ClientApiException extends RuntimeException {\n private final ApiProblem problem;\n\n public ClientApiException(ApiProblem problem) {\n super(problem.getDetail());\n this.problem = problem;\n }\n\n public ApiProblem getProblem() {\n return problem;\n }\n\n public String getErrorCode() {\n return (String) problem.getExtensions().get(\"errorCode\");\n }\n}\n```\n\n---\n\n## ⚠️ Common Mistakes\n\n### Mistake 1: Exposing Internal Details\n\n```java\n// ❌ Leaking internal info\nproblem.setDetail(ex.getMessage()); // May contain SQL, stack trace, etc.\nproblem.setProperty(\"query\", sqlQuery); // Security risk!\n\n// ✅ Generic message for server errors\nif (ex instanceof TechnicalException) {\n problem.setDetail(\"An unexpected error occurred\"); // Generic\n log.error(\"Internal error\", ex); // Log full details\n}\n```\n\n### Mistake 2: Inconsistent Error Codes\n\n```java\n// ❌ No standard\n{ \"error\": \"not_found\" }\n{ \"errorCode\": \"404\" }\n{ \"code\": \"USER_NOT_FOUND\" }\n\n// ✅ Consistent format\n{ \"type\": \"https://api.example.com/errors/user-not-found\", \"errorCode\": \"USER_001\" }\n```\n\n---\n\n## 🐛 Debug This: The Leaking Stack Trace\n\nA security audit reveals: \"API responses include full stack traces and SQL queries in production!\"\n\n```java\n@RestControllerAdvice\npublic class GlobalExceptionHandler {\n\n @ExceptionHandler(Exception.class)\n public ResponseEntity> handleException(Exception ex) {\n Map error = new HashMap<>();\n error.put(\"message\", ex.getMessage());\n\n // BUG: This exposes internal details!\n error.put(\"stackTrace\", Arrays.toString(ex.getStackTrace()));\n error.put(\"cause\", ex.getCause() != null ? ex.getCause().getMessage() : null);\n\n // This can leak SQL queries and table names\n if (ex instanceof DataAccessException) {\n error.put(\"query\", ((DataAccessException) ex).getMessage());\n }\n\n return ResponseEntity.status(500).body(error);\n }\n}\n\n// Response in production:\n// {\n// \"message\": \"could not execute query\",\n// \"stackTrace\": \"[OrderRepository.findByCustomerId(OrderRepository.java:42), ...]\",\n// \"cause\": \"ERROR: relation \\\"orders\\\" does not exist\",\n// \"query\": \"SELECT * FROM orders WHERE customer_id = 12345 AND password = 'secret'\"\n// }\n```\n\n**What sensitive information is being exposed and how would you fix it?**\n\n---\n\n**✅ Solution:**\n\nMultiple security issues:\n\n1. **Stack traces** - Reveal internal class names, line numbers, library versions\n2. **Cause messages** - Can expose database schema, table names\n3. **SQL queries** - Can expose column names, sometimes even query parameters\n4. **Exception messages** - May contain user data or system details\n\n**Secure implementation:**\n\n```java\n@RestControllerAdvice\n@Slf4j\npublic class GlobalExceptionHandler {\n\n @ExceptionHandler(Exception.class)\n public ResponseEntity handleException(\n Exception ex, HttpServletRequest request) {\n\n // Generate trace ID for correlation\n String traceId = UUID.randomUUID().toString().substring(0, 8);\n\n // Log full details server-side (not exposed to client)\n log.error(\"Error [traceId={}]: {} at {}\",\n traceId, ex.getClass().getName(), request.getRequestURI(), ex);\n\n // Return sanitized response\n ApiProblem problem = ApiProblem.builder()\n .type(\"https://api.example.com/errors/internal-error\")\n .title(\"Internal Server Error\")\n .status(HttpStatus.INTERNAL_SERVER_ERROR)\n .detail(\"An unexpected error occurred. Please try again.\")\n .instance(request.getRequestURI())\n .extension(\"traceId\", traceId) // For support lookup\n // NO stack trace, NO cause, NO query!\n .build();\n\n return ResponseEntity.status(500).body(problem);\n }\n\n // Business exceptions CAN show detail (user-facing)\n @ExceptionHandler(BusinessException.class)\n public ResponseEntity handleBusiness(\n BusinessException ex, HttpServletRequest request) {\n\n log.warn(\"Business error: {}\", ex.getMessage());\n\n ApiProblem problem = ApiProblem.builder()\n .type(\"https://api.example.com/errors/\" + ex.getErrorCode())\n .title(ex.getTitle())\n .status(ex.getHttpStatus())\n .detail(ex.getMessage()) // Safe - business-controlled message\n .instance(request.getRequestURI())\n .build();\n\n return ResponseEntity.status(ex.getHttpStatus()).body(problem);\n }\n}\n```\n\n**The lesson:** Never expose stack traces, causes, or internal details to clients. Log everything server-side with a correlation ID, return only sanitized messages to users.\n\n---\n\n## 💻 Exercises\n\n### Exercise 1: Basic RFC 7807 Response\n⭐ Difficulty: Easy | ⏱️ Time: 15 minutes\n\n**Task:** Create a simple RFC 7807 problem response.\n\n```java\n// Create ApiProblem class with:\n// - type, title, status, detail, instance\n// - Builder pattern\n// - Proper JSON serialization\n```\n\n**✅ Solution:**\n\n```java\n@JsonInclude(JsonInclude.Include.NON_NULL)\npublic class ApiProblem {\n private URI type;\n private String title;\n private int status;\n private String detail;\n private URI instance;\n private Instant timestamp;\n\n @JsonAnyGetter\n private Map extensions = new HashMap<>();\n\n private ApiProblem(Builder builder) {\n this.type = builder.type;\n this.title = builder.title;\n this.status = builder.status;\n this.detail = builder.detail;\n this.instance = builder.instance;\n this.timestamp = Instant.now();\n this.extensions = builder.extensions;\n }\n\n public static Builder builder() {\n return new Builder();\n }\n\n // Getters...\n\n public static class Builder {\n private URI type = URI.create(\"about:blank\");\n private String title;\n private int status;\n private String detail;\n private URI instance;\n private Map extensions = new HashMap<>();\n\n public Builder type(String type) {\n this.type = URI.create(type);\n return this;\n }\n\n public Builder title(String title) {\n this.title = title;\n return this;\n }\n\n public Builder status(HttpStatus status) {\n this.status = status.value();\n return this;\n }\n\n public Builder detail(String detail) {\n this.detail = detail;\n return this;\n }\n\n public Builder instance(String path) {\n this.instance = URI.create(path);\n return this;\n }\n\n public Builder extension(String key, Object value) {\n this.extensions.put(key, value);\n return this;\n }\n\n public ApiProblem build() {\n return new ApiProblem(this);\n }\n }\n}\n```\n\n---\n\n### Exercise 2: Exception Handler with Metrics\n⭐⭐ Difficulty: Medium | ⏱️ Time: 20 minutes\n\n**Task:** Create an exception handler that records error metrics.\n\n```java\n// Handler should:\n// - Record error counts by type and status\n// - Sanitize paths to avoid high cardinality\n// - Include trace ID in response and logs\n```\n\n**✅ Solution:**\n\n```java\n@RestControllerAdvice\n@Slf4j\npublic class MetricsExceptionHandler {\n\n private final MeterRegistry meterRegistry;\n\n public MetricsExceptionHandler(MeterRegistry meterRegistry) {\n this.meterRegistry = meterRegistry;\n }\n\n @ExceptionHandler(Exception.class)\n public ResponseEntity handleException(\n Exception ex, HttpServletRequest request) {\n\n String traceId = MDC.get(\"traceId\");\n if (traceId == null) {\n traceId = UUID.randomUUID().toString().substring(0, 8);\n }\n\n HttpStatus status = determineStatus(ex);\n String errorType = ex.getClass().getSimpleName();\n String sanitizedPath = sanitizePath(request.getRequestURI());\n\n // Record metric\n meterRegistry.counter(\"api.errors\",\n \"type\", errorType,\n \"path\", sanitizedPath,\n \"status\", String.valueOf(status.value()),\n \"method\", request.getMethod()\n ).increment();\n\n // Log with correlation\n log.error(\"Error [traceId={}, path={}, status={}]: {}\",\n traceId, request.getRequestURI(), status.value(),\n ex.getMessage(), ex);\n\n ApiProblem problem = ApiProblem.builder()\n .type(determineType(ex))\n .title(status.getReasonPhrase())\n .status(status)\n .detail(determineSafeMessage(ex))\n .instance(request.getRequestURI())\n .extension(\"traceId\", traceId)\n .extension(\"timestamp\", Instant.now())\n .build();\n\n return ResponseEntity.status(status).body(problem);\n }\n\n private String sanitizePath(String path) {\n return path\n .replaceAll(\"/\\\\d+\", \"/{id}\")\n .replaceAll(\"/[a-f0-9-]{36}\", \"/{uuid}\")\n .replaceAll(\"/[A-Za-z0-9]{20,}\", \"/{token}\");\n }\n\n private HttpStatus determineStatus(Exception ex) {\n if (ex instanceof BusinessException be) return be.getHttpStatus();\n if (ex instanceof AuthenticationException) return HttpStatus.UNAUTHORIZED;\n if (ex instanceof AccessDeniedException) return HttpStatus.FORBIDDEN;\n return HttpStatus.INTERNAL_SERVER_ERROR;\n }\n\n private String determineType(Exception ex) {\n String base = \"https://api.example.com/errors/\";\n if (ex instanceof BusinessException be) return base + be.getErrorCode();\n return base + \"internal-error\";\n }\n\n private String determineSafeMessage(Exception ex) {\n if (ex instanceof BusinessException) return ex.getMessage();\n return \"An unexpected error occurred\";\n }\n}\n```\n\n---\n\n### Exercise 3: Error Catalog\n⭐⭐ Difficulty: Medium | ⏱️ Time: 20 minutes\n\n**Task:** Create a centralized error catalog with predefined error types.\n\n```java\n// Create ErrorCatalog enum with:\n// - Error code, title, HTTP status\n// - Method to generate ApiProblem\n// - Categories (validation, auth, business, system)\n```\n\n**✅ Solution:**\n\n```java\npublic enum ErrorCatalog {\n // Validation (400)\n VALIDATION_FAILED(\"VAL_001\", \"Validation Failed\", HttpStatus.BAD_REQUEST),\n INVALID_FORMAT(\"VAL_002\", \"Invalid Format\", HttpStatus.BAD_REQUEST),\n\n // Authentication (401)\n INVALID_CREDENTIALS(\"AUTH_001\", \"Invalid Credentials\", HttpStatus.UNAUTHORIZED),\n TOKEN_EXPIRED(\"AUTH_002\", \"Token Expired\", HttpStatus.UNAUTHORIZED),\n\n // Authorization (403)\n ACCESS_DENIED(\"AUTHZ_001\", \"Access Denied\", HttpStatus.FORBIDDEN),\n\n // Not Found (404)\n RESOURCE_NOT_FOUND(\"NOT_FOUND_001\", \"Resource Not Found\", HttpStatus.NOT_FOUND),\n USER_NOT_FOUND(\"NOT_FOUND_002\", \"User Not Found\", HttpStatus.NOT_FOUND),\n\n // Conflict (409)\n DUPLICATE_RESOURCE(\"CONFLICT_001\", \"Duplicate Resource\", HttpStatus.CONFLICT),\n\n // Business Rules (422)\n BUSINESS_RULE_VIOLATION(\"BIZ_001\", \"Business Rule Violation\", HttpStatus.UNPROCESSABLE_ENTITY),\n INSUFFICIENT_FUNDS(\"BIZ_002\", \"Insufficient Funds\", HttpStatus.UNPROCESSABLE_ENTITY),\n\n // Server (500)\n INTERNAL_ERROR(\"SYS_001\", \"Internal Error\", HttpStatus.INTERNAL_SERVER_ERROR),\n SERVICE_UNAVAILABLE(\"SYS_002\", \"Service Unavailable\", HttpStatus.SERVICE_UNAVAILABLE);\n\n private static final String TYPE_BASE = \"https://api.example.com/errors/\";\n\n private final String code;\n private final String title;\n private final HttpStatus status;\n\n ErrorCatalog(String code, String title, HttpStatus status) {\n this.code = code;\n this.title = title;\n this.status = status;\n }\n\n public ApiProblem toProblem(String detail, String instance) {\n return ApiProblem.builder()\n .type(TYPE_BASE + code.toLowerCase().replace(\"_\", \"-\"))\n .title(title)\n .status(status)\n .detail(detail)\n .instance(instance)\n .extension(\"errorCode\", code)\n .build();\n }\n\n public ApiProblem toProblem(String detail, String instance, Map extras) {\n ApiProblem.Builder builder = ApiProblem.builder()\n .type(TYPE_BASE + code.toLowerCase().replace(\"_\", \"-\"))\n .title(title)\n .status(status)\n .detail(detail)\n .instance(instance)\n .extension(\"errorCode\", code);\n\n extras.forEach(builder::extension);\n return builder.build();\n }\n\n public String getCode() { return code; }\n public String getTitle() { return title; }\n public HttpStatus getStatus() { return status; }\n}\n\n// Usage\nErrorCatalog.USER_NOT_FOUND.toProblem(\n \"User with ID 123 not found\",\n \"/api/users/123\"\n);\n\nErrorCatalog.VALIDATION_FAILED.toProblem(\n \"3 validation errors\",\n \"/api/orders\",\n Map.of(\"errors\", validationErrors)\n);\n```\n\n---\n\n### Exercise 4: Validation Error Formatting\n⭐⭐⭐ Difficulty: Medium-Hard | ⏱️ Time: 20 minutes\n\n**Task:** Handle Spring validation errors with detailed field-level information.\n\n```java\n// Handle MethodArgumentNotValidException and ConstraintViolationException\n// Return structured error response with field details\n```\n\n**✅ Solution:**\n\n```java\n@RestControllerAdvice\npublic class ValidationExceptionHandler {\n\n @ExceptionHandler(MethodArgumentNotValidException.class)\n public ResponseEntity handleValidation(\n MethodArgumentNotValidException ex,\n HttpServletRequest request) {\n\n List fieldErrors = ex.getBindingResult().getFieldErrors()\n .stream()\n .map(fe -> new FieldError(\n fe.getField(),\n fe.getDefaultMessage(),\n fe.getRejectedValue() != null ?\n sanitizeValue(fe.getRejectedValue()) : null))\n .toList();\n\n ApiProblem problem = ApiProblem.builder()\n .type(\"https://api.example.com/errors/validation-failed\")\n .title(\"Validation Failed\")\n .status(HttpStatus.BAD_REQUEST)\n .detail(String.format(\"%d field(s) failed validation\", fieldErrors.size()))\n .instance(request.getRequestURI())\n .extension(\"errors\", fieldErrors)\n .build();\n\n return ResponseEntity.badRequest().body(problem);\n }\n\n @ExceptionHandler(ConstraintViolationException.class)\n public ResponseEntity handleConstraintViolation(\n ConstraintViolationException ex,\n HttpServletRequest request) {\n\n List errors = ex.getConstraintViolations()\n .stream()\n .map(cv -> new FieldError(\n extractFieldName(cv.getPropertyPath()),\n cv.getMessage(),\n cv.getInvalidValue() != null ?\n sanitizeValue(cv.getInvalidValue()) : null))\n .toList();\n\n ApiProblem problem = ApiProblem.builder()\n .type(\"https://api.example.com/errors/constraint-violation\")\n .title(\"Constraint Violation\")\n .status(HttpStatus.BAD_REQUEST)\n .detail(\"Request parameter validation failed\")\n .instance(request.getRequestURI())\n .extension(\"errors\", errors)\n .build();\n\n return ResponseEntity.badRequest().body(problem);\n }\n\n private String extractFieldName(Path path) {\n String fullPath = path.toString();\n int lastDot = fullPath.lastIndexOf('.');\n return lastDot >= 0 ? fullPath.substring(lastDot + 1) : fullPath;\n }\n\n private String sanitizeValue(Object value) {\n String str = String.valueOf(value);\n // Don't expose potentially sensitive values\n if (str.length() > 50) {\n return str.substring(0, 47) + \"...\";\n }\n return str;\n }\n\n public record FieldError(String field, String message, String rejectedValue) {}\n}\n```\n\n---\n\n### Exercise 5: Client Error Handling\n⭐⭐⭐⭐ Difficulty: Hard | ⏱️ Time: 25 minutes\n\n**Task:** Create an API client that properly handles RFC 7807 error responses.\n\n```java\n// Client should:\n// - Parse ApiProblem from error responses\n// - Map to typed exceptions\n// - Preserve error details for debugging\n```\n\n**✅ Solution:**\n\n```java\npublic class ApiClient {\n private final RestClient restClient;\n private final ObjectMapper objectMapper;\n\n public ApiClient(String baseUrl, ObjectMapper objectMapper) {\n this.objectMapper = objectMapper;\n this.restClient = RestClient.builder()\n .baseUrl(baseUrl)\n .defaultHeader(\"Accept\", \"application/json\")\n .build();\n }\n\n public T get(String path, Class type) {\n return restClient.get()\n .uri(path)\n .retrieve()\n .onStatus(HttpStatusCode::isError, this::handleError)\n .body(type);\n }\n\n public R post(String path, T body, Class responseType) {\n return restClient.post()\n .uri(path)\n .body(body)\n .retrieve()\n .onStatus(HttpStatusCode::isError, this::handleError)\n .body(responseType);\n }\n\n private void handleError(HttpRequest request, ClientHttpResponse response)\n throws IOException {\n\n ApiProblem problem;\n try {\n problem = objectMapper.readValue(\n response.getBody(), ApiProblem.class);\n } catch (Exception e) {\n problem = ApiProblem.builder()\n .status(HttpStatus.valueOf(response.getStatusCode().value()))\n .title(\"Unknown Error\")\n .detail(\"Failed to parse error response\")\n .build();\n }\n\n throw mapToException(problem, response.getStatusCode());\n }\n\n private ApiClientException mapToException(\n ApiProblem problem, HttpStatusCode status) {\n\n return switch (status.value()) {\n case 400 -> new ApiValidationException(problem);\n case 401 -> new ApiAuthenticationException(problem);\n case 403 -> new ApiAuthorizationException(problem);\n case 404 -> new ApiNotFoundException(problem);\n case 409 -> new ApiConflictException(problem);\n case 422 -> new ApiBusinessException(problem);\n case 429 -> new ApiRateLimitException(problem);\n default -> status.is5xxServerError()\n ? new ApiServerException(problem)\n : new ApiClientException(problem);\n };\n }\n}\n\n// Base exception\npublic class ApiClientException extends RuntimeException {\n private final ApiProblem problem;\n\n public ApiClientException(ApiProblem problem) {\n super(problem.getDetail());\n this.problem = problem;\n }\n\n public ApiProblem getProblem() {\n return problem;\n }\n\n public String getErrorCode() {\n return (String) problem.getExtensions().get(\"errorCode\");\n }\n\n public int getStatus() {\n return problem.getStatus();\n }\n}\n\n// Specific exceptions\npublic class ApiValidationException extends ApiClientException {\n public ApiValidationException(ApiProblem problem) {\n super(problem);\n }\n\n @SuppressWarnings(\"unchecked\")\n public List> getFieldErrors() {\n Object errors = getProblem().getExtensions().get(\"errors\");\n return errors instanceof List ? (List>) errors : List.of();\n }\n}\n\npublic class ApiNotFoundException extends ApiClientException {\n public ApiNotFoundException(ApiProblem problem) {\n super(problem);\n }\n}\n\n// Usage\ntry {\n User user = apiClient.get(\"/users/123\", User.class);\n} catch (ApiNotFoundException e) {\n log.warn(\"User not found: {}\", e.getProblem().getDetail());\n} catch (ApiValidationException e) {\n e.getFieldErrors().forEach(err ->\n log.warn(\"Validation: {} - {}\", err.get(\"field\"), err.get(\"message\")));\n} catch (ApiClientException e) {\n log.error(\"API error: {} ({})\", e.getMessage(), e.getErrorCode());\n}\n```\n\n---\n\n## 📝 Summary\n\n| Component | Purpose |\n|-----------|---------|\n| type | URI identifying error type |\n| title | Human-readable summary (same for all instances) |\n| status | HTTP status code |\n| detail | Specific explanation for this occurrence |\n| instance | URI of the request |\n| extensions | Custom fields (errorCode, traceId, errors[]) |\n\n---\n\n## 📅 Review Schedule for This Article\n\n| Day | Task | Time |\n|-----|------|------|\n| Day 1 | Review RFC 7807 structure diagram | 5 min |\n| Day 3 | Redo Exercise 1 (Basic RFC 7807 Response) | 15 min |\n| Day 7 | Answer interview questions without looking | 10 min |\n| Day 14 | Redo Debug This (Leaking Stack Trace) | 15 min |\n| Day 30 | Audit your API's error responses for RFC 7807 compliance | 20 min |\n\n---\n\n*Next: [Part 17: Bean Validation]*\n","featuredImage","isPublished","isFeatured","subscriptionType","BASIC","publishedAt","2026-06-10T07:19:24.837475Z","createdAt","2026-06-10T07:19:24.838209Z","updatedAt","2026-06-16T21:26:56.086200Z","readingTimeMinutes",15,"estimatedReadingTime","authorId",3,"authorUsername","tomasz_main","categoryName","Java","readingTime","seriesId","seriesOrder",16,"author",{"_31":55,"_97":57,"_98":99,"_100":101,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5},"category",{"_31":93,"_72":59,"_35":94,"_75":95,"_96":-5},"tags",[78,79,80,81],"series",{"_31":16,"_72":73,"_35":74,"_75":76,"_77":23},"name","Advanced Clean Code Patterns: From Principles to Production Mastery","advanced-clean-code-patterns","description","A comprehensive 26-part series covering enterprise-grade clean code patterns for Java developers. From SOLID principles and code smells through refactoring patterns, error handling, validation, to legacy modernization and modern Java 21+ features. Includes real production stories, mental models, exercises, and 150+ interview questions.","isActive",{"_31":90,"_72":91,"_35":92},{"_31":87,"_72":88,"_35":89},{"_31":85,"_72":34,"_35":86},{"_31":82,"_72":83,"_35":84},78,"Spring Boot","spring-boot",76,"global-error-handling",77,"Controlleradvice","controlleradvice",79,"Api Errors","api-errors",5,"java","Category for Java","colorHex","username","firstName","Tomasz","lastName","Jarosz","profilePicture","bio","website","githubUrl","linkedinUrl"]