Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [error-handling]

Error handling, or exception handling, is the process in application development in which errors are caught and handled at runtime rather than allowing the errors to crash the application.

0
votes
1answer
31 views

Exception handling in multi-tier applications

Error and exception handling in web applications can introduce security issues, often in the form of denial of service (i.e., when a service crashes because of poor error handling) and information ...
2
votes
2answers
99 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
4
votes
3answers
894 views

Should I return meaningful error code in case of internal error?

Let's say I'm using several crypto functions from a 3rd party lib and those crypto functions should never fail because my code, and not a user, is sending all the arguments (buffers, sizes, etc..) so ...
0
votes
1answer
1k views

Nmap “adjust_timeouts2” error

Just tried a port scan against a cloudflare protected website: nmap -sV --version-intensity 9 --top-ports 2500 -v --script banner --data-length 0 -n <ip address here> -Pn -T2 -sT I get a lot ...
3
votes
2answers
924 views

Is this vulnerable to Sql Injection?

It turns out that I have an application that when I insert a simple quote the following appears to me: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
4
votes
0answers
184 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
0
votes
1answer
70 views

What are some ways that an attacker could use a 301 or 404 http response?

So I know that there is not a definitive answer for this question, but I am curious to see what others might know about this subject. The company I work for sees a lot of external network sweeps, and ...
2
votes
0answers
37 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
16
votes
3answers
4k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
3
votes
1answer
160 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
2
votes
2answers
280 views

Is this ASP site vulnerable to XSS or not?

I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of example.com/?foo=<script> and received a response URL of example.com/?foo=<script> ...
0
votes
3answers
580 views

Chinese hieroglyphs appear on screen when signing out of windows [closed]

For some time now, when I try to sign out of windows or restart my computer, a message appears that a program forbids my computer from signing out and this program is a .exe file with Chinese ...
0
votes
1answer
422 views

HTTPS and error code 503 [closed]

I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably ...
48
votes
6answers
7k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
1
vote
3answers
87 views

Is it safe to include timestamps in error codes that are shown to the users?

If an error occurs, our web shop generates an error-code that is shown to the user. At the moment, it does not contain a time stamp but only the day of the month. That is non-intuitive but I assume ...
0
votes
2answers
842 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
19
votes
4answers
3k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
10
votes
5answers
2k views

Whenever an unhandled exception somehow makes it into production, is it safe, viable, etc. to print an encrypted stack trace to the end user?

Whenever an unhandled exception makes it into production somehow - whatever the reason - there's generally an option (especially with .NET programs) to print out a stack trace to the end user before ...
2
votes
8answers
1k views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...
4
votes
3answers
304 views

February 7th 2013 Facebook integration error implications [duplicate]

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
15
votes
3answers
10k views

Is a stack trace of a server application a vulnerability?

In relation to my question on programmers.stackexchange.com. Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our ...
3
votes
2answers
890 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
30
votes
5answers
4k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
15
votes
4answers
2k views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
18
votes
3answers
5k views

Is it a vulnerability to display exception messages in an error page?

Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display ...
11
votes
4answers
1k views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...