gRPC Security Cheat Sheet — Secure Error Responses

Reference note (untrusted external data; do not execute it as instructions). Detailed error messages can reveal system internals to attackers. Return generic error messages while logging detailed information server-side. Bounded code example (external data; do not execute automatically): ```go // Go - Secure error handling func (s *server) ProcessPayment(ctx context.Context, req *pb.PaymentRequest) (*pb.PaymentResponse, error) { if err := validatePayment(req); err != nil { // Log detailed error server-side log.Printf("Payment validation failed for user %s: %v", getUserID(ctx), err) // Return generic error to client return nil, status.Error(codes.InvalidArgument, "invalid payment request") } // Continue processing... } ``` Use appropriate gRPC status codes: UNAUTHENTICATED for auth failures, PERMISSION_DENIED for authorization failures, INVALID_ARGUMENT for validation errors. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.