All 15 Global Exception Handling & Middleware questions
More in Global Exception Handling & Middleware
How does the IExceptionHandler interface (introduced in .NET 8) provide a more structured alternative to the UseExceptionHandler lambda approach? How do you map different exception types to different HTTP status codes in a global exception handler? How do you handle exceptions specifically within minimal API endpoints, given they don't use the traditional MVC exception filter pipeline? What is the difference between handling exceptions with middleware versus using try/catch blocks directly in controller actions? What is the role of the [ApiController] attribute in automatically handling certain error scenarios without explicit exception handling code? How do you write an integration test verifying that your global exception handler produces the correct error response shape? What is ProblemDetails (RFC 7807/9457), and how does ASP.NET Core support it for standardized error responses? What information should be excluded from error responses in production to avoid leaking sensitive implementation details? How would you implement custom middleware to catch and log unhandled exceptions before they reach the exception handler, adding request-specific context? How does exception handling middleware interact with model validation errors in ASP.NET Core, and how do they typically produce different error response paths?
Advertisement
.NET › Global Exception Handling & Middleware

How should a global exception handler differentiate between exceptions that should return specific client-facing details versus exceptions that should always show a generic message?

Intermediate

Answer

A common pattern defines a custom base exception class (like ApiException with a public Message and StatusCode meant for client display) that business logic throws for expected, user-facing error conditions, while any exception NOT inheriting from this base type (unexpected bugs, infrastructure failures) is treated as an internal error and given only a generic message -- this explicit opt-in design prevents accidentally leaking internal exception details for the many exception types never designed to be shown to end users.
public class ApiException : Exception {
    public int StatusCode { get; }
    public ApiException(string message, int statusCode = 400) : base(message) => StatusCode = statusCode;
}

// In the handler:
var (status, message) = exception is ApiException apiEx
    ? (apiEx.StatusCode, apiEx.Message)  // safe, intentionally client-facing
    : (500, "An unexpected error occurred");  // generic for anything else
Real-world example A checkout flow throws a custom InsufficientStockException : ApiException with a clear customer-facing message, while an unrelated database timeout exception (not inheriting ApiException) is automatically shown only as a generic 'something went wrong' message, preventing internal details from leaking.

Common follow-ups: How do you ensure developers consistently use the ApiException base class for new user-facing errors?;What's the risk of accidentally making ApiException too broadly applicable?

Exception Handling;RESTful Web APIs & Controllers
All 15 Global Exception Handling & Middleware questions