Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the browser will typically be sent a detailed exception information with a stack trace, while production mode will only serve a generic (though customizable) error page that is devoid of any more detailed information.
The frameworks' documentation will also typically warn against using development mode in production for this reason; this is an example from .NET Core:
Warning Enable the Developer Exception Page only when the app is running in the Development environment. You don't want to share detailed exception information publicly when the app runs in production.
And this is a similar warning from Django docs:
Never deploy a site into production with
One of the main features of debug mode is the display of detailed error pages. If your app raises an exception when
True, Django will display a detailed traceback, including a lot of metadata about your environment, such as all the currently defined Django settings (from
I'm failing to understand the reasoning behind the aforementioned security measures?
If I understand, the reasoning goes like that: Detailed error pages would allow a potential attacker to discover details about the app's source code = they might find weaknesses = bad. Isn't it the definition of security through obscurity?
In addition: What is the use of such measures if the app is open-sourced? Disabling detailed exception pages is supposed to prevent the attacker from finding out details about its source code, but these are - by design - present in a public GitHub repository. Seemingly in this case I might just as well run the app in development mode, at least if there is an unexpected bug a user finds out they will be able to give me a more detailed information that might help me fix this bug?
If the reasoning behind the documentation warnings I quoted above is correct, then this would mean to me that developing open-sourced webapps is itself a security vulnerability! Because if allowing an attacker to find some details abou the source code is such a big deal, then how worse must it be to simply give out the source code to anyone interested! And yet, AFAIK, open source is not considered an invalid and inherently insecure model.
What am I missing here? Why should detailed exception pages be disabled?