JerseySupport error response masking hard coded

[dansiviter]

Environment Details

• Helidon Version: 2.2.1-SNAPSHOT
• Helidon SE or Helidon MP
• JDK version: N/A
• OS: N/A
• Docker version (if applicable):

---

Problem Description

Hiding/masking of error responses is hard coded in JerseySupport.java#119. With applications that already sanitise the error responses there is often a desire to be able to consume the payload.

This has two problems:

• Moving away from default behaviour of Jersey Client which will cause confusion,
• Not possible to disable.

IMO this is opt-in behaviour and should be neither the default or hard-coded.

Steps to reproduce

N/A

[spericas]

@dansiviter We absolutely need to change the default as this behavior presents a security risk. The app can override this by re-setting the property, but I agree this can be tricky as it depends on the loading of JerseySupport. One possible minor improvement would be for the code to make sure the property is unset (null) before setting it. The way an app could override this externally. Would that help in your case?

Application developers can also define their own exception mappers.

[dansiviter]

Thinking about it, if we can just have this come from the normal configuration mechanism this would suffice. Happy for it to default to true if we can globally set this (but not via System properties 😄).

Update: deleted my previous comment as my thoughts have shifted a little.

[spericas]

PR #2737