Disable limited exception pages in production
Disable limited exception pages in production

Rails has a default of showing limited exceptions in production, IF it thinks
the request is local/from a trusted proxy (and not being proxied from the
internet). Our infrastructure is telling apps that all requests actually come
from trusted proxies, even though they don't, hence our problem.

A wrinkle is that we have apps that are talking to each other, so it's
conceivable that information could get from an inter-app request that errored
and then be displayed to the outside world.

The problem would be limited if the proxies set the headers correctly, but
eliminated if we set config.action_dispatch.show_exceptions to false.

Nick has dealt with the problem in such a way that prevents exception
information being shown, but which also hides helpful 4xx and 5xx messages
(eg if you don't have "signin" permission for an app, you get a 403 and
explanatory HTML, but now it gets clobbered). I'm sure there are other cases.

theodi/panopticon,alphagov/panopticon,theodi/panopticon,alphagov/panopticon,theodi/panopticon,alphagov/panopticon,alphagov/panopticon,theodi/panopticon