2015-07-20
reported as https://github.com/edicl/hunchentoot/issues/105

Hunchentoot is meant to hide error details from web users unless
*show-lisp-errors-p* is overridden to true. But it doesn't always
hide them.

Here is how hunchentoot renders errors:

a) if there's an error template html file use it, otherwise
b) cook up a message whose level of detail depends on *show-lisp-errors-p*
   and *show-lisp-backtraces-p*

As distributed, hunchentoot contains a 500.html error template file,
so that is used and there is no need to cook up a message in code.

The provided 500.html error template prints out the error message
and backtrace, regardless of *show-lisp-errors-p* and
*show-lisp-backtraces-p*.

Refs:

acceptor.lisp -> defgeneric #'acceptor-status-message documentation
acceptor.lisp -> #'make-cooked-message -> +http-internal-server-error+ clause
www/errors/500.html

Workaround:

Set your acceptor's error-template-directory to nil, causing
hunchentoot to bypass (a) above.

(make-instance 'easy-acceptor :port 8000 :error-template-directory nil)