ASP.NET Web API removing HttpError from responses -

i'm building restful service using microsoft asp.net web api.

my problem concerns httperrors web api throws user when go wrong (e.g. 400 bad request or 404 not found).

the problem is, don't want serialized httperror in response content, provides information, therefore violates owasp security rules, example:

request:

http://localhost/service/api/something/555555555555555555555555555555555555555555555555555555555555555555555 

as response, 400 of course, following content information:

{  "$id": "1",  "message": "the request invalid.",  "messagedetail": "the parameters dictionary contains null entry parameter 'id'  of non-nullable type 'system.int32' method 'mynamespaceandmethodhere(int32)' in 'service.controllers.mycontroller'. optional parameter must reference type, nullable type, or declared optional parameter." } 

something not indicates webservice based on asp.net webapi technology (which isn't bad), gives information namespaces, method names, parameters, etc.

i tried set includeerrordetailpolicy in global.asax

globalconfiguration.configuration.includeerrordetailpolicy = includeerrordetailpolicy.never; 

yeah, did somehow good, result doesn't contain messagedetail section, still, don't want httperror @ all.

i built custom delegatinghandler, affects 400s , 404s myself generate in controllers, don't want happen.

my question is: there convinient way rid of serialized httperror response content? want user bad requests response code.

what using custom ihttpactioninvoker ? basically, have send empty httpresponsemessage.

here basic example :

public class myapicontrolleractioninvoker : apicontrolleractioninvoker {     public override task<httpresponsemessage> invokeactionasync(httpactioncontext actioncontext, system.threading.cancellationtoken cancellationtoken)     {         var result = base.invokeactionasync(actioncontext, cancellationtoken);          if (result.exception != null)         {             //log critical error             debug.writeline("unhandled exception ");              return task.run<httpresponsemessage>(() => new httpresponsemessage(httpstatuscode.internalservererror));         }         else if (result.result.statuscode!= httpstatuscode.ok)         {             //log critical error             debug.writeline("invalid response status");              return task.run<httpresponsemessage>(() => new httpresponsemessage(result.result.statuscode));         }           return result;     } } 

in global.asax

globalconfiguration.configuration.services.replace(typeof(ihttpactioninvoker), new myapicontrolleractioninvoker()); 

one other important thing do, not related web api, remove excessive asp.net & iis http headers. here explanation.