should Exceptions always be public

Question

I know that it is a good thing to always make exceptions serializable. But should I also always make them public? Even if they should only be caught internally? I wonder if there potentially be any security issues or serialization problems (e.g. marshalling across appdomains) if the exceptions are not public.

score 4 · Accepted Answer · answered Aug 01 '11 at 16:50

4

Yes, they should.

If you know that the exception will always be caught by your own code, then it is OK to make it internal.

answered Aug 01 '11 at 16:50

SLaks

800,742
167
1,811
1,896

But that page says it's okay to suppress that rule if "you're sure the exception only ever used privately", which was part of the OP's assertion. – Sven Aug 01 '11 at 16:51
Not really: the cause clause says "A non-public exception derives **directly from** Exception, SystemException, or ApplicationException." – Vlad Aug 01 '11 at 16:52

score 4 · Answer 2 · answered Aug 01 '11 at 16:55

In fact, there is nothing bad in having internal exceptions if they are not a part of your interface. This means however that

either the exception must absolutely never cross the borders of your module,
or you provide a public base exception which the users of your module can catch.

In fact, it's a good idea to declare a public base exception type for your module, so your users can always rely on it in their catch clauses. The individual exceptions derived from the base class may be public if you prefer, but may be not as well.

Please note that you absolutely must not rely on public/private mechanism in order to ensure any kind of security, because it can be easily overridden with plain reflection.

score 0 · Answer 3 · answered Aug 01 '11 at 16:53

It is the same as scoping anything. Everything should be in the proper scope.

If you create an exception in a specific class and only use that exception inside the class, then it should only have a scope inside the class, and so it should be private. However, this is not common.

The second you have an exception that will be handed to another object calling your class, you should make it public. This is the most common use of an exception, so most exceptions should be public.

score 0 · Answer 4 · answered Aug 01 '11 at 16:57

Consider this... How far up the chain is an exception going to reach? If an exception is going to be thrown from a public function then it should be public itself.

That said, if the exception is always caught within your library and either never thrown or re-badged and thrown as something else, it can be internal.

Ideally, I'd have this scenario:

namespace MyAPI
{
    public class PublicException : System.Exception
    {
    }

    // derive my public exceptions from this
    public class CatchableException : PublicException
    {
    }

    // stuff that should never reach the users of my API
    internal class InvisibleException : System.Exception
    {
    }
}

This way, the users of my API have a facility to catch any exception that I throw. Internal ones never make it that far.

should Exceptions always be public

4 Answers4