The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Use Generic Error Messages

The application should never return verbose error messages or debug infor-

mation to the user’s browser. When an unexpected event occurs (such as an

error in a database query, a failure to read a file from disk, or an exception in

an external API call), the application should return the same, generic message

informing the user that an error occurred. If it is necessary to record debug

information for support or diagnostic purposes, then this should be held in a

server-side log which is not publicly accessible, and an index number to the

relevant log entry may be returned to the user, enabling them to report this

when contacting the helpdesk, if required.

Most application platforms and web servers can be configured to mask error

information from being returned to the browser:

■■

In ASP.NET, verbose error messages can be suppressed using the 

customErrors

element of the 

Web.config

file, by setting the mode

attribute to 

On

or 

RemoteOnly

and specifying a custom error page in the

defaultRedirect

node.

■■

In the Java Platform, customized error messages can be configured

using the error-page element of the 

web.xml

file. The 

exception-type

node can be used to specify a Java exception type, or the 

error-code

node used to specify an HTTP status code, and the custom page to 

be displayed in the event of the specified error can be set using the

location

node.