Is it safe to log JavaScript exceptions to the error console?

Question

I know that on the server side it's very bad to display system-level errors instead of logging them to disk, because it could expose potentially sensitive information, but do the same concerns apply to client-side languages like JavaScript?

e.g.,

try {
    foo();
} catch ( exception ) {
    if ( window.console ) {
        console.log( exception );
    }
}

Since everything is already accessible to the browser/user, I can't think of real problems.

The only thing I could find on the web was one example of outputting a password on a login form:

But the troublesome thing is that there may be an easy temptation to console.log() something very sensitive, like console.log(password_entered). [...] the fact that they obviously have a process in place which does not properly filter out [temporary debugging output] means that at some point they may accidentally expose something they would otherwise not want to (or their users wouldn’t want!).

I'm as paranoid as the next guy, but that seems a bit silly. Even in an extreme case like a password being exposed, wouldn't an attacker who was able to view it already have all the access they need? Or am I overlooking something?

Answer 1

It is safe as everything on the client-side is, by definition, already accessible client-side.

If you're worried about the password being exposed and read by passers by of the user's screen, then normal users will not have the console active. If they did, it would also be possible to see the password entered via the Network tab:

_{Screenshot taken from this question}.

It would be best practise though to disable console debug output on production sites. For pre-production it might be wise to filter out passwords in case they are accidentally copied into bug reports, but these being test accounts the risk should be low.

Answer 2

It is safe simply because even the least skilled attacker can simply add their own. And the java-script is only really knows what the end user already knows anyway.

But on that note it is also poor programming practice to produce excessive console output.