Beware the Error Message

404 error message

I hope that you already know that users hate meaningless error messages. (Actually they hate all error messages - don't we all!) So that's one reason to not allow default messages to display in your web application.

But there is another important reason: security!

Read the error message

That's something I often remind developers about on course. Read the error message so that you understand the error. But that doesn't mean you should display the errors to everyone.

Of course, in an ideal world, your web application will not have errors. But until then, it is important that you write code to properly handle errors, and not just display the default internal error messages to the user.

Why? Because unlike the rest of us, hackers are very good at reading error messages. There is a surprising amount of information in the error message.

Example

Here's a simple example of a standard HTTP 404 Not Found error.

Not Found
The requested URL /page.html was not found on this server.
Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7g  DAV/2 
PHP/5.1.2 Server at localhost Port 80

That error tells the hacker the web server version, the OS and the code used. Now they can design a more effective attack.

The information disclosed via standard error messages may include valuable information such as the database system, database usernames, file system paths, and other useful configuration information. That might enable a hacker to target your system with the “right” code injection!

Find the balance

You have to find the balance between an error message that is helpful to the user, and an error message that is helpful to the hacker.

With a failed logon attempt, for example, your error can be:

Invalid username / password

If you use a more specific error, such as Invalid password, you effectively tell the hacker that the username was valid.

Extra reading

Here are some useful sites for more information:

Leave a Comment

Your email address will not be published. Required fields are marked *

Thank You

We're Excited!

Thank you for completing the form. We're excited that you have chosen to contact us about training. We will process the information as soon as we can, and we will do our best to contact you within 1 working day. (Please note that our offices are closed over weekends and public holidays.)

Don't Worry

Our privacy policy ensures your data is safe: Incus Data does not sell or otherwise distribute email addresses. We will not divulge your personal information to anyone unless specifically authorised by you.

If you need any further information, please contact us on tel: (27) 12-666-2020 or email info@incusdata.com

How can we help you?

Let us contact you about your training requirements. Just fill in a few details, and we’ll get right back to you.