Development » CompressPdf

Description¶

Module/Section: API → /api/shared/{fieldId}
Profile: API
Issue Category: Functional

When a non-existent fieldId is provided, the API correctly returns a 404 Not Found, which is expected behavior.
However, the error message inadvertently exposes internal routing details:
Cannot POST /api/shared/8ed6c643-d4cb-486c-a446-08b180c093f6

This could pose a potential security risk.

Steps to Reproduce¶

1. Send a POST request to /api/shared/{fieldId} using a non-existent fieldId.
2. Observe the error message returned in the response.

Expected Result¶

The API should return a 404 Not Found without exposing internal routing details or backend paths.

Actual Result¶

The API returns 404 Not Found, but the error message exposes internal route information, which may pose a security risk.

Root Cause¶

Impacted Area¶

Attachments¶

• PoC