title: How to intercept IQueryable exceptions
body: <p>During a Security review at the company I work for, an issue was raised with a Web.API returning too much information if the user were to change for the example the order by value that is provided.</p>
  
  <p>Example of a legitimate call: <a href="https://mysite/controller/myData" rel="nofollow">https://mysite/controller/myData</a>?$orderby=realcolumn</p>
  
  <p>Example of a malicious call: <a href="https://mysite/controller/myData" rel="nofollow">https://mysite/controller/myData</a>?$orderby=fakecolumn</p>
  
  <p>In the second case, the api is returning: </p>
  
  <pre><code>{
    "$id": "1",
    "$type": "System.Web.Http.HttpError, System.Web.Http",
    "Message": "The query specified in the URI is not valid. Could not find a property named 'fakecolumn' on type 'MyObject.Models.MyData."
  }
  </code></pre>
  
  <p>While I do not see this as being a large security concern and as a developer having this type of response is helpful...  I am being asked to make this more generic – basically provide as little information as possible.</p>
  
  <p>I don’t know how to trap this prior to sending the response back to the user.  If I walk through the code and stop prior to returning the result, the data is there.  In this case the order by doesn’t appear to be evaluated until after the return occurs in the controller.  Is there a way to perform the evaluation at the server, trap for errors like this and return a more generic response?</p>
  
  <p>Code snippets below, I appreciate any assistance provided.</p>
  
  <p><strong>From the Controller</strong></p>
  
  <pre><code>RepositoryMyData _repo;
  
  [HttpGet]
  public IQueryable&lt;myData&gt; myData()
  {
     return _repo.myData();
  }
  </code></pre>
  
  <p><strong>From the Repository class – using Entity Framework…</strong></p>
  
  <pre><code>public DbQuery&lt;myData&gt; myData()
  {
     return (DbQuery&lt;myData&gt;)_contextProvider.Context.myData
  }
  </code></pre>