5

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view.

I think it is common sense that exposing error details like exceptions and stacktraces to 'untrusted' users is bad practice and at least can weaken your application security through information disclosure (internal structure, dependencies, etc.).

The solution on the server-side can be solved by ensuring to not expose any error details to your users and storing the details securely on the server. This way the error details can be looked up later by dedicated people during an investigation when needed.

But how can you accomplish to store the error details on the client without exposing it to the user?

A few things came to my mind but each is flawed at certain points.

  1. Sending error details to a dedicated server where they are stored for later lookup.
    • How to send error details for problems in the communication layer (no external communication is possible at all)?
    • Your log server is not accessible from the client network (firewall rules, proxies, etc.).
  2. Asymmetric encrypt error details
    • Potential performance impact during logging.
    • Error details must be decrypted during the error investigation, which makes the process more cumbersome.

On the other hand, you can argument that exposing error details from a client application is not as critical as for error details from a server application.

  • The users already have access to the client binary that can be used gather internal information (reverse-engineering).
  • Most communication details can be gathered by sniffing the traffic between client and server.
  • Internal knowledge about a client application is (in most cases) not as valuable as about the server, because the client acts mainly as an UI and the essential business logic resides on the server.

What are the 'best practices' or the best compromises to store error details on the client from a security point of view? Or to put it differently, is it worth to hide error details (exceptions, stacktraces, etc.) for a client application?

0

I think best practice you should not display full exceptions and stack traces in your GUI to the user. Show them just a friendly message like "sorry, contact our help desk"

If you want to store errors locally to sync them to the mothership at a later date that seams reasonable , just don't store them in a clear text file or on a screen in the GUI. Store them in a file that has restricted permissions . Or store them in a local file that is encrypted. Or store them in a local database that is protected with all your other sensitive data.

If an attacker is already on the box and snooping around they probably aren't that interested in their error messages. If they are serious about breaking into your app they probably will use a debugger and / or reverse it so again probably not too concerned about your error messages.

One big thing to consider when logging errors is ensuring you are sanitizing out sensitive things like passwords, customer data, credit cards, ssns, PII, etc so that they are not in your logs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.