Exception and error information can be used by a malicious user to map out the API of an web application, so it is routine to see security checklists to advise returning only a "Please contact your administrator" type of message.
On the otherhand, we are encouraged to use HTTP standards, which recommend errors such as
- 400 -- bad request
- 401 -- unauthorized
- 403 -- forbidden
- 405 -- method not allowed
- 500 -- internal error
- 501 -- not implemented
Those all seem to provide some information about the API, namely that such an invocation exists and while your attack was close to a properly formatted request, it wasn't close enough.
Should all of these HTTP request be translated to the same error message, or should standards compliance prevail?
UPDATE: As an application developer, personally I prefer fairly rich exception messages and don't like that most apps I work on return 200 for everything that the application returns and only returns non-200 errors when ASP.NET or IIS feels like returning a non-200 error.