2

I know that on the server side it's very bad to display system-level errors instead of logging them to disk, because it could expose potentially sensitive information, but do the same concerns apply to client-side languages like JavaScript?

e.g.,

try {
    foo();
} catch ( exception ) {
    if ( window.console ) {
        console.log( exception );
    }
}

Since everything is already accessible to the browser/user, I can't think of real problems.

The only thing I could find on the web was one example of outputting a password on a login form:

But the troublesome thing is that there may be an easy temptation to console.log() something very sensitive, like console.log(password_entered). [...] the fact that they obviously have a process in place which does not properly filter out [temporary debugging output] means that at some point they may accidentally expose something they would otherwise not want to (or their users wouldn’t want!).

I'm as paranoid as the next guy, but that seems a bit silly. Even in an extreme case like a password being exposed, wouldn't an attacker who was able to view it already have all the access they need? Or am I overlooking something?

  • On a shared-usage computer, is it possible a second person could get access a logged password at a later time? Do browsers ensure that the console.log is never written to disk? – WW. Feb 5 '18 at 2:01
3

It is safe as everything on the client-side is, by definition, already accessible client-side.

If you're worried about the password being exposed and read by passers by of the user's screen, then normal users will not have the console active. If they did, it would also be possible to see the password entered via the Network tab:

Dev Tools

Screenshot taken from this question.

It would be best practise though to disable console debug output on production sites. For pre-production it might be wise to filter out passwords in case they are accidentally copied into bug reports, but these being test accounts the risk should be low.

0

It is safe simply because even the least skilled attacker can simply add their own. And the java-script is only really knows what the end user already knows anyway.

But on that note it is also poor programming practice to produce excessive console output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.