What is the danger of setting IIS errorMode to detailed in webconfig? It helps me marginally with sanity checks on production, but it seems like it wouldn't really help a bad actor much. I'd like to set production to detailed errors, but I find people warning against that with little to back it up. Am I totally off base?


1 Answer 1


Even when error messages don’t provide a lot of detail, inconsistencies in such messages can still reveal important clues on how a site works, and what information is present under the covers. For example, when a user tries to access a file that does not exist, the error message typically indicates, “file not found”. When accessing a file that the user is not authorized for, it indicates, “access denied”. The user is not supposed to know the file even exists, but such inconsistencies will readily reveal the presence or absence of inaccessible files or the site’s directory structure.

Check this for more detailed information

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .