A PHP application that I am currently testing returned and error page when the value of session cookie is set as a huge string. It leads to information disclosure also. What can I recommend the developer to prevent the generation of error page when the cookie value is overflown?
The problem is caused by the app expecting the cookie's value to be something without first checking if that value is indeed something to be able to exit gracefully if it's not, and instead ends up throwing an (unhandled) exception.
What the developer should do first is to disable error display on the production servers and instead just returning a 500 error with an optional user-friendly error page, or at least a blank page to avoid information disclosure.
I don't think there is a need to explicitly validate the cookie's value, this isn't something an user can input and make a typo so there's no need for validation and an error page like "cookie not valid", someone would need to intentionally modify that cookie's value in which case it's normal that the app isn't expecting that and just throws a 500 error - as long as PHP is correctly configured to not disclose sensitive information on error and instead log it.
The application gives an error exposing sensitive information because that specific error is not handled by the developer. The developer should either sanitize the data or handle the error giving HTTP 500 error. More info