Skip to content

fix: sanitize HTML error responses and remove duplicate done event#283

Open
octo-patch wants to merge 1 commit into11cafe:mainfrom
octo-patch:fix/sanitize-api-error-messages
Open

fix: sanitize HTML error responses and remove duplicate done event#283
octo-patch wants to merge 1 commit into11cafe:mainfrom
octo-patch:fix/sanitize-api-error-messages

Conversation

@octo-patch
Copy link
Copy Markdown

Fixes #258

Problem

When the Jaaz API is blocked by Cloudflare or other intermediaries (firewalls, rate limiters), the OpenAI SDK raises a PermissionDeniedError whose string representation contains the full HTML error page. This page is then forwarded verbatim to the frontend as the error message, showing users a wall of raw HTML markup instead of a helpful, actionable message.

Example of what users see in the error toast:

Error: <!DOCTYPE html><!--[if lt IE 7]>...Sorry, you have been blocked...Cloudflare Ray ID...

Solution

1. Sanitize HTML error responses in _handle_error

Detect when the error string starts with < (HTML content) and replace it with a clear, user-friendly message that explains what likely happened and what to do. Also truncate any excessively long error strings (> 1000 chars) to prevent the UI from being flooded.

2. Remove duplicate done event from StreamProcessor.process_stream

chat_service.py already sends a done event in its finally block, which runs regardless of success, error, or cancellation. StreamProcessor was also sending its own done at the end of a successful stream, causing the frontend to receive the event twice on success. Removing the redundant one from StreamProcessor keeps the control flow clean.

Testing

  • Start the server and trigger an API call that returns an HTML error page (e.g., block the API endpoint at the firewall level)
  • Verify the frontend shows the clean error message instead of raw HTML
  • Normal successful chat flows should be unaffected

When the Jaaz API is blocked by Cloudflare or other intermediaries,
the OpenAI SDK raises a PermissionDeniedError whose string contains the
full HTML page. This gets forwarded to the frontend, showing users raw
HTML markup instead of a helpful error message.

- In _handle_error: detect HTML responses (starting with '<') and
  replace with a clear, actionable message; truncate strings over 1000 chars
- In StreamProcessor.process_stream: remove the redundant 'done' event
  since chat_service.py already sends it in the finally block

Fixes 11cafe#258
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cloudfare block

1 participant