Documentation
Installation Using the Xperience interface Developing websites Configuring Xperience Managing users Securing websites Deploying websites Managing website content Multilingual websites Macro expressions External utilities Integrating 3rd party systems Custom development E-commerce features On-line marketing features Release notes - Xperience 13 Xperience terminology glossary
Tutorial
Using the Xperience interface Developer tutorial Business tutorial Resource hub for marketers
API Examples
Configuration Content management Development E-commerce On-line marketing Social media

Handling error messages securely

CoreMVC 5

Displaying information to users in error messages is an important issue which you should pay attention to. Revealing some pieces of information (for example stack trace or debug data) can pose a security risk to your site, while not providing enough information would not help the users at all. To ensure that the error messages in your system are handled properly, follow these procedures:

Design error messages in a way that does not allow potential attackers to gain exploitable knowledge about the system. See Designing secure error messages.
Create your own error pages, which will be displayed instead of the default ones. It is important to present unified error messages throughout the system, for all types of errors. See Handling 404 errors.
Before going live with your website, disable debugging in error messages. See Web.config security settings.

Displaying information to users in error messages is an important issue which you should pay attention to. Revealing some pieces of information (for example stack trace or debug data) can pose a security risk to your site, while not providing enough information would not help the users at all. To ensure that the error messages in your system are handled properly, follow these procedures:

Design error messages in a way that does not allow potential attackers to gain exploitable knowledge about the system. See Designing secure error messages.
Create your own error pages, which will be displayed instead of the default ones. It is important to present unified error messages throughout the system, for all types of errors. See Handling 404 errors.
Before going live with your website, disable debugging in error messages. See Web.config security settings.

Cookie consent