2

If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed?

Caller -> Service A -> Service B -> Service B error

Error codes:
ServiceA-000001
ServiceB-000001
ServiceC-000001

So if I send a request to A I know it talks to B and somehow I learn I can exploit this chain.

So shouldn’t our error codes be completely obscure to what microservice failed?

The question is sorta confirming my suspicion, but what are pros, cons and arguments to support this?

2 Answers 2

1

A core security principle applies here - obscurity is not security.

In this case you should evaluate the business benefits to troubleshoot and understand the system against how easy you make an attacker’s job at learning about your system.

The attacker can figure most of the architecture stuff out anyways. Your security model should assume they already know such that leaking the information you describe is low risk.

Tl;dr;

It’s usually better to assume the bad guys already know how the micro services interconnect.

Then you can focus attention on making sure there are no vulnerabilities with the micro services.

There is a trade off. If you obfuscate the trace information in the error codes then it’s more difficult for your engineers to understand how the services interoperate. If your team cannot easily understand how things work, how can they evaluate design weaknesses?

By obfuscating how your system works, you also obfuscate it from your staff.

By making the system transparent, it’s transparent to your staff as well. And you can focus on fixing vulnerabilities and design vulnerabilities.

This is why we trust AES over a proprietary and obfuscated cypher - it’s open and tested.

However, information asymmetry is still an advantage to whoever has more of it. The real value in the principle is to plan security after assuming the bad guys know everything. You should absolutely still keep information confidential. But also assume the bad guy knows or will know. IE, at any time the adversary can learn your architecture so never assume they don’t/can’t.

1
  • The server could return an obfuscated error code which is immediately replaced by the client with a human readable code, like hdyek becomes ServiceA-000001.
    – gnasher729
    Commented Dec 25, 2023 at 20:24
0

Yes, I would say that these error code prefixes introduce unnecessary risk.

OWASP's Application Security Verification Standards covers this nicely:

7.4.1 Verify that a generic message is shown when an unexpected or security sensitive error occurs, potentially with a unique ID which support personnel can use to investigate.

The correct place for the information revealing exactly which microservice failed, and how, is the logging / observability systems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .