A PHP application that I am currently testing returned and error page when the value of session cookie is set as a huge string. It leads to information disclosure also. What can I recommend the developer to prevent the generation of error page when the cookie value is overflown?

2 Answers 2


The problem is caused by the app expecting the cookie's value to be something without first checking if that value is indeed something to be able to exit gracefully if it's not, and instead ends up throwing an (unhandled) exception.

What the developer should do first is to disable error display on the production servers and instead just returning a 500 error with an optional user-friendly error page, or at least a blank page to avoid information disclosure.

I don't think there is a need to explicitly validate the cookie's value, this isn't something an user can input and make a typo so there's no need for validation and an error page like "cookie not valid", someone would need to intentionally modify that cookie's value in which case it's normal that the app isn't expecting that and just throws a 500 error - as long as PHP is correctly configured to not disclose sensitive information on error and instead log it.

  • The message should also ask the user to clear their cookies for the domain (e.g. *.example.com) otherwise it'd recur. The only thing I can think that would cause this in real life would be a cookie poisoning attack - in this case with view to denial of service. The app itself could not clear cookies if they had been set on a subdomain without knowing that subdomain itself. Jan 22, 2015 at 15:46

The application gives an error exposing sensitive information because that specific error is not handled by the developer. The developer should either sanitize the data or handle the error giving HTTP 500 error. More info

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .