I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view.
I think it is common sense that exposing error details like exceptions and stacktraces to 'untrusted' users is bad practice and at least can weaken your application security through information disclosure (internal structure, dependencies, etc.).
The solution on the server-side can be solved by ensuring to not expose any error details to your users and storing the details securely on the server. This way the error details can be looked up later by dedicated people during an investigation when needed.
But how can you accomplish to store the error details on the client without exposing it to the user?
A few things came to my mind but each is flawed at certain points.
- Sending error details to a dedicated server where they are stored for later lookup.
- How to send error details for problems in the communication layer (no external communication is possible at all)?
- Your log server is not accessible from the client network (firewall rules, proxies, etc.).
- Asymmetric encrypt error details
- Potential performance impact during logging.
- Error details must be decrypted during the error investigation, which makes the process more cumbersome.
On the other hand, you can argument that exposing error details from a client application is not as critical as for error details from a server application.
- The users already have access to the client binary that can be used gather internal information (reverse-engineering).
- Most communication details can be gathered by sniffing the traffic between client and server.
- Internal knowledge about a client application is (in most cases) not as valuable as about the server, because the client acts mainly as an UI and the essential business logic resides on the server.
What are the 'best practices' or the best compromises to store error details on the client from a security point of view? Or to put it differently, is it worth to hide error details (exceptions, stacktraces, etc.) for a client application?