hyperium
Status API and propagation
The Tonic API allows for easy propagation of errors between clients and servers. E.g.
fn server_handler(_) -> Result<_, tonic::Status> {
_ = client.outgoing_call(_).await? // Return any client status as a server status
}
This usage is problematic for two reasons:
-
If the status code is directly propagated, then it can cause correctness issues. E.g. if the client above returned INVALID_ARGUMENT, then that probably should go back from the outer service as INTERNAL, since it was likely a programmer error in the service making the call to the client.
-
If the trailers are propagated along with the status, then that's a security issue, since they could contain sensitive information.
I believe we need a change that prevents ? from being able to propagate statuses in this way, e.g. by having a different Status type returned by servers than the one given to clients.
