should RESTX_ERROR_404_HELP be disabled by default?

[frankli0324]

Ask a question

background: I came through https://github.com/python-restx/flask-restx/issues/550 and went to https://github.com/flask-restful/flask-restful/issues/780, I see similar behaviors in both libraries. I use restx. at least it seems to me that author to restful believes the option should never have been existed.

I believe that RESTX_ERROR_404_HELP should at least be disabled by default because:

• it causes confusion. I spent some time finding who's responsible for the extra error message.
• there could be security concerns. it could help attackers enumerate the routes.

[peter-doggart]

I'm interested to see other people's opinion on if this is a big issue for them?

I'm always a little bit weary of making any changes to the defaults because they cause breaking changes for user's upgrading versions.