Skip to main content
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link

A stack trace is an information leak, which reveals information about your implementation. Whilst not a serious vulnerability, it does allow an attacker to gain certain information about your system. It may also allow them to use a debugging-based approach to exploiting flaws in your site.

One might argue that the stack trace in itself is a vulnerability, since nobody should be able to crash your site in such a way.

Ignoring the security implications, it's not exactly confidence-inducing for your customers to see a stacktrace. They'll assume the site is broken (which it is, really) and worry about whether their transaction will work, or perhaps even think that the site has been hacked.

Further reading: Is it a vulnerability to display exception messages in an error page?Is it a vulnerability to display exception messages in an error page?

A stack trace is an information leak, which reveals information about your implementation. Whilst not a serious vulnerability, it does allow an attacker to gain certain information about your system. It may also allow them to use a debugging-based approach to exploiting flaws in your site.

One might argue that the stack trace in itself is a vulnerability, since nobody should be able to crash your site in such a way.

Ignoring the security implications, it's not exactly confidence-inducing for your customers to see a stacktrace. They'll assume the site is broken (which it is, really) and worry about whether their transaction will work, or perhaps even think that the site has been hacked.

Further reading: Is it a vulnerability to display exception messages in an error page?

A stack trace is an information leak, which reveals information about your implementation. Whilst not a serious vulnerability, it does allow an attacker to gain certain information about your system. It may also allow them to use a debugging-based approach to exploiting flaws in your site.

One might argue that the stack trace in itself is a vulnerability, since nobody should be able to crash your site in such a way.

Ignoring the security implications, it's not exactly confidence-inducing for your customers to see a stacktrace. They'll assume the site is broken (which it is, really) and worry about whether their transaction will work, or perhaps even think that the site has been hacked.

Further reading: Is it a vulnerability to display exception messages in an error page?

Source Link
Polynomial
  • 135.8k
  • 44
  • 309
  • 383

A stack trace is an information leak, which reveals information about your implementation. Whilst not a serious vulnerability, it does allow an attacker to gain certain information about your system. It may also allow them to use a debugging-based approach to exploiting flaws in your site.

One might argue that the stack trace in itself is a vulnerability, since nobody should be able to crash your site in such a way.

Ignoring the security implications, it's not exactly confidence-inducing for your customers to see a stacktrace. They'll assume the site is broken (which it is, really) and worry about whether their transaction will work, or perhaps even think that the site has been hacked.

Further reading: Is it a vulnerability to display exception messages in an error page?