Timeline for Is it a vulnerability to display exception messages in an error page?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 11, 2011 at 4:47 | comment | added | D.W. | @Soumya92, @Matthew - makes sense. The web2py web framework implements that model automatically (you get it by default, without any extra work). It is a nice model. | |
| Jun 10, 2011 at 18:13 | comment | added | Matthew Rodatus | @Soumya92 Thanks. > "At best, give them an ID they can correlate to your log." -- we are changing our page to do that. It will provide a generic error message, an apology for the inconvenience, the current date, and a number for us to be able to correlate their report to the log entry. | |
| Jun 10, 2011 at 18:04 | comment | added | user2796 | @Hendrik I prefer using an internal log file, or email if the app is high priority, while displaying a generic error. At best, give them an ID they can correlate to your log. That way, developers get a lot to work on, but attackers get nothing. | |
| Jun 10, 2011 at 13:20 | comment | added | Hendrik Brummermann | Depending on the concrete situation it may be a good idea to have two modes of the application: A development mode which shows all the details and a production mode which display "Ooops, we are sorry an error occurred. Our support team has been notified of this error and will take appropriate actions to fix it." page. Don't confuse users with error messages they cannot do anything about. | |
| Jun 10, 2011 at 4:18 | answer | added | D.W. | timeline score: 3 | |
| Jun 9, 2011 at 23:28 | history | edited | AviD♦ |
edited tags
|
|
| Jun 9, 2011 at 18:19 | comment | added | Matthew Rodatus | @Simon I think none. | |
| Jun 9, 2011 at 17:25 | history | tweeted | twitter.com/#!/StackSecurity/status/78875360510488576 | ||
| Jun 9, 2011 at 17:19 | comment | added | Simon Richter | I'd think of it the other way 'round: what potential benefit would showing the error message to the user have? | |
| Jun 9, 2011 at 17:11 | answer | added | atdre | timeline score: 9 | |
| Jun 9, 2011 at 14:45 | vote | accept | Matthew Rodatus | ||
| Jun 9, 2011 at 14:27 | answer | added | Thomas Pornin | timeline score: 21 | |
| Jun 9, 2011 at 14:22 | history | edited | Matthew Rodatus | CC BY-SA 3.0 |
added 93 characters in body
|
| Jun 9, 2011 at 14:12 | history | asked | Matthew Rodatus | CC BY-SA 3.0 |