SignalR: hub method exceptions leak stack traces to clients by default in development

When a SignalR hub method throws an exception, ASP.NET Core sends the exception message and stack trace to the client in development mode. In production the details are stripped, but developers sometimes push a dev config to staging, exposing internals.

Configure detailed errors explicitly per environment:

builder.Services.AddSignalR(options =>
{
    options.EnableDetailedErrors = builder.Environment.IsDevelopment();
});

Handle hub errors on the client side:

connection.on("ReceiveMessage", (message) => { /* ... */ });
connection.start().catch(err => console.error(err));

For structured hub error responses, use a hub filter:

public class ErrorHandlingFilter : IHubFilter
{
    public async ValueTask<object?> InvokeMethodAsync(
        HubInvocationContext context,
        Func<HubInvocationContext, ValueTask<object?>> next)
    {
        try { return await next(context); }
        catch (AppException ex) { throw new HubException(ex.Message); }
    }
}

HubException is the only exception type whose message is forwarded to the client as-is in production. All other exception types have their messages stripped to prevent information leakage.