Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [error-handling]

Error handling, or exception handling, is the process in application development in which errors are caught and handled at runtime rather than allowing the errors to crash the application.

Filter by
Sorted by
Tagged with
0 votes
1 answer
103 views

What's wrong with toggling detailed IIS errors for production?

What is the danger of setting IIS errorMode to detailed in webconfig? It helps me marginally with sanity checks on production, but it seems like it wouldn't really help a bad actor much. I'd like to ...
Robert Palmer's user avatar
2 votes
1 answer
206 views

Error code prefixes specific to specific micro services a vulnerability?

If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed? ...
visc's user avatar
  • 121
0 votes
1 answer
106 views

Error message when logging in with valid credentials while registration not complete

I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated. Now what error message ...
Robert Niestroj's user avatar
2 votes
1 answer
322 views

Credit card form : Is it neccessary to obscure error messages?

I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream"). Upon some transaction errors the upstream returns the ...
Christopher Smith's user avatar
1 vote
1 answer
661 views

API Returning Java Exception. Safe?

I just wanted to ask if my concerns here are valid. I am aware that it is unsafe for the API to return a stack trace. I have a similar, but less egregious, situation that I am trying to judge. Is ...
somexp12's user avatar
  • 113
4 votes
3 answers
2k views

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:
s1rrv's user avatar
  • 63
0 votes
2 answers
156 views

Is there a problem with this approach to handling invalid web probes?

Like any other website owner, I get frequent probes for vulnerabilities e.g. .php .sql or .gz pages. These used to appear in my log files as 404 responses (we host on ASP.NET Core). These also take ...
Quango's user avatar
  • 101
0 votes
0 answers
2k views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
Ananda Sai A's user avatar
0 votes
0 answers
254 views

Does Asp.Net Core exposes too much information for required enums that were not supplied?

I have a simple code for an input model: public class MyClass { [Required] public MyEnum? Type { get; set; } } Now if I do not send Type as a part of json to the request, I get this error ...
Ilya Chernomordik's user avatar
0 votes
1 answer
147 views

Secure error messages from public API

We are writing our first public API. Now I remember hearing in the past that you shouldn't give users useful error messages, that allows hackers to learn what your data is. so if the get is { ...
WendyG's user avatar
  • 101
39 votes
7 answers
14k views

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
csrowell's user avatar
  • 487
3 votes
1 answer
191 views

Leak multiple lines from file

I am researching this bug here, where the first line of an arbitrary file can be leaked by triggering a SyntaxError using the compile() function. Is there a method of leaking the rest of the file, ...
isopach's user avatar
  • 511
0 votes
2 answers
600 views

Pickle Shellcode Import Error

I'm trying to execute pickle shell-code through a download function on a website but I get the following error: <html> <h1>ERROR: Cannot load file</h1> <!-- Traceback (most ...
John's user avatar
  • 1
0 votes
2 answers
220 views

Exception handling in multi-tier applications [closed]

Error and exception handling in web applications can introduce security issues, often in the form of denial of service (i.e., when a service crashes because of poor error handling) and information ...
NLuburić's user avatar
  • 304
2 votes
2 answers
458 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
SeeYouInDisneyland's user avatar
4 votes
3 answers
1k views

Should I return meaningful error code in case of internal error?

Let's say I'm using several crypto functions from a 3rd party lib and those crypto functions should never fail because my code, and not a user, is sending all the arguments (buffers, sizes, etc..) so ...
Gil-Mor's user avatar
  • 155
1 vote
1 answer
7k views

Nmap "adjust_timeouts2" error

Just tried a port scan against a cloudflare protected website: nmap -sV --version-intensity 9 --top-ports 2500 -v --script banner --data-length 0 -n <ip address here> -Pn -T2 -sT I get a lot ...
new_to_nmap_guy's user avatar
4 votes
2 answers
3k views

Is this vulnerable to Sql Injection?

It turns out that I have an application that when I insert a simple quote the following appears to me: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
user152754's user avatar
7 votes
3 answers
487 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
lgraf's user avatar
  • 171
0 votes
1 answer
209 views

What are some ways that an attacker could use a 301 or 404 http response?

So I know that there is not a definitive answer for this question, but I am curious to see what others might know about this subject. The company I work for sees a lot of external network sweeps, and ...
Tyler Gallenbeck's user avatar
2 votes
0 answers
113 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
KeithS's user avatar
  • 6,768
21 votes
3 answers
8k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
Ilya Chernomordik's user avatar
3 votes
1 answer
303 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
Polynomial's user avatar
  • 135k
2 votes
2 answers
547 views

Is this ASP site vulnerable to XSS or not?

I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of example.com/?foo=<script> and received a response URL of example.com/?foo=<script> ...
Suhass's user avatar
  • 21
0 votes
3 answers
747 views

Chinese hieroglyphs appear on screen when signing out of windows [closed]

For some time now, when I try to sign out of windows or restart my computer, a message appears that a program forbids my computer from signing out and this program is a .exe file with Chinese ...
Random Guest's user avatar
0 votes
1 answer
696 views

HTTPS and error code 503 [closed]

I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably ...
Marko's user avatar
  • 69
50 votes
6 answers
8k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
Kevin's user avatar
  • 501
1 vote
3 answers
450 views

Is it safe to include timestamps in error codes that are shown to the users?

If an error occurs, our web shop generates an error-code that is shown to the user. At the moment, it does not contain a time stamp but only the day of the month. That is non-intuitive but I assume ...
Philipp Claßen's user avatar
0 votes
2 answers
1k views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
MickJ's user avatar
  • 125
19 votes
4 answers
4k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
CodyBugstein's user avatar
10 votes
5 answers
2k views

Whenever an unhandled exception somehow makes it into production, is it safe, viable, etc. to print an encrypted stack trace to the end user?

Whenever an unhandled exception makes it into production somehow - whatever the reason - there's generally an option (especially with .NET programs) to print out a stack trace to the end user before ...
Panzercrisis's user avatar
2 votes
8 answers
2k views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...
Aard-Wolf's user avatar
4 votes
3 answers
363 views

February 7th 2013 Facebook integration error implications [duplicate]

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
zedman9991's user avatar
  • 3,407
22 votes
3 answers
19k views

Is a stack trace of a server application a vulnerability?

In relation to my question on programmers.stackexchange.com. Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our ...
Vilx-'s user avatar
  • 1,040
3 votes
2 answers
1k views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
Hope4You's user avatar
  • 333
33 votes
5 answers
6k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
IMB's user avatar
  • 2,968
17 votes
4 answers
2k views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
JD Isaacks's user avatar
18 votes
3 answers
8k views

Is it a vulnerability to display exception messages in an error page?

Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display ...
Matthew Rodatus's user avatar
11 votes
4 answers
2k views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
VirtuosiMedia's user avatar