Handling error messages securely

✖
Copy to clipboard

Displaying information to users in error messages is an important issue which you should pay attention to. Revealing some pieces of information (for example stack trace or debug data) can pose a security risk to your site, while not providing enough information would not help the users at all. To ensure that the error messages in your system are handled properly, follow these procedures:

  • Design error messages in a way that does not allow potential attackers to gain exploitable knowledge about the system. See Designing secure error messages.
  • Create your own error pages, which will be displayed instead of the default ones. It is important to present unified error messages throughout the system, for all types of errors. See Handling 404 errors.
  • Before going live with your website, disable debugging in error messages. See Web.config security settings.