Improper Error Handling - OWASP Foundation

source initiatives and community education. Donate Now!

6/21/24, 10:45 AM Improper Error Handling | OWASP Foundation

Store Donate  Store Join Donate
PROJECTS CHAPTERS EVENTS
ABOUT  Join
Improper Error Handling Watch 169 Star 1,048
Contributor(s): Jeremy Ferragamo, Wichers, Jim Bird, kingthorin

The OWASP® Foundation
Description works to improve the
Improper handling of errors can introduce a variety security of software through
of security problems for a web site. The most its community-led open
common problem is when detailed internal error source software projects,
hundreds of chapters
messages such as stack traces, database dumps,
worldwide, tens of
and error codes are displayed to the user (hacker).
thousands of members, and
These messages reveal implementation details
by hosting local and global
that should never be revealed. Such details can
conferences.
provide hackers important clues on potential flaws
in the site and such messages are also disturbing
to normal users.
Web applications frequently generate error Upcoming OWASP
conditions during normal operation. Out of
Global Events
memory, null pointer exceptions, system call
OWASP Global AppSec
failure, database unavailable, network timeout, and
Lisbon 2024
hundreds of other common conditions can cause
errors to be generated. These errors must be June 24-28, 2024
handled according to a well thought out scheme OWASP Global AppSec
that will provide a meaningful error message to the San Francisco 2024
user, diagnostic information to the site maintainers,
September 23-27, 2024
and no useful information to an attacker.
OWASP Global AppSec
Even when error messages don’t provide a lot of
Washington DC 2025
detail, inconsistencies in such messages can still
reveal important clues on how a site works, and November 3-7, 2025
what information is present under the covers. For OWASP Global AppSec
example, when a user tries to access a file that San Francisco 2026
https://owasp.org/www-community/Improper_Error_Handling 1/5
indicates, file not found . When accessing a file
that the
6/21/24, user is not authorized for, it indicates,
10:45 AM Improper Error Handling | OWASP Foundation
“access denied”. The user is not supposed to know

the file even exists, but such inconsistencies will
readily reveal the presence or absence of
inaccessible files or the site’s directory structure.
One common security problem caused by improper

error handling is the fail-open security check. All
security mechanisms should deny access until
specifically granted, not grant access until denied,
which is a common reason why fail open errors
occur. Other errors can cause the system to crash
or consume significant resources, effectively
denying or reducing service to legitimate users.
Good error handling mechanisms should be able to

handle any feasible set of inputs, while enforcing
proper security. Simple error messages should be
produced and logged so that their cause, whether
an error in the site or a hacking attempt, can be
reviewed. Error handling should not focus solely on
input provided by the user, but should also include
any errors that can be generated by internal
components such as system calls, database
queries, or any other internal functions.
Environments Affected
All web servers, application servers, and web
application environments are susceptible to error
handling problems.
Examples and References

OWASP Testing Guide
How to Determine If You Are

Vulnerable
site responds to various kinds of input errors. More
thorough testing is usually required to cause
internal errors to occur and see how the site

behaves.
Another valuable approach is to have a detailed

code review that searches the code for error
handling logic. Error handling should be consistent
across the entire site and each piece should be a
part of a well-designed scheme. A code review will
reveal how the system is intended to handle
various types of errors. If you find that there is no
organization to the error-handling scheme or that
there appear to be several different schemes, there
is quite likely a problem.
How to Protect Yourself

A specific policy for how to handle errors should be
documented, including the types of errors to be
handled and for each, what information is going to
be reported back to the user, and what information
is going to be logged. All developers need to
understand the policy and ensure that their code
follows it.
In the implementation, ensure that the site is built

to gracefully handle all possible errors. When
errors occur, the site should respond with a
specifically designed result that is helpful to the
user without revealing unnecessary internal details.
Certain classes of errors should be logged to help
detect implementation flaws in the site and/or
hacking attempts. Very few sites have any intrusion
detection capabilities in their web application, but it
is certainly conceivable that a web application
could track repeated failed attempts and generate
alerts. Note that the vast majority of web
application attacks are never detected because so
few sites have the capability to detect them.
security attacks is likely to be seriously
underestimated.
Edit on GitHub
Spotlight: Root
Root is the fastest way to achieve software acceptance and zero vulnerabilities. We are a
robust two-sided SaaS platform designed to enhance transparency and trust in application
security. By seamlessly integrating with your existing tools like vulnerability scanners, ticketing
systems, and CI/CD pipelines, Root streamlines the security verification process, enabling
quicker acceptance of software releases through clear communication and effective
collaboration.
Corporate Supporters
Become a corporate supporter
PRIVACY SITEMAP CONTACT
OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec
California, AppSec Cali, SnowFROC, and LASCON are trademarks of the OWASP Foundation, Inc. Unless
otherwise specified, all content on the site is Creative Commons Attribution-ShareAlike v4.0 and provided
without warranty of service or accuracy. For more information, please refer to our General Disclaimer.
OWASP does not endorse or recommend commercial products or services, allowing our community to
remain vendor neutral with the collective wisdom of the best minds in software security worldwide. Copyright
2024, OWASP Foundation, Inc.

Improper Error Handling - OWASP Foundation

Uploaded by

Copyright:

Available Formats

Improper Error Handling - OWASP Foundation

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Improper Error Handling - OWASP Foundation

Uploaded by

Copyright:

Available Formats

source initiatives and community education. Donate Now!

Contributor(s): Jeremy Ferragamo, Wichers, Jim Bird, kingthorin

“access denied”. The user is not supposed to know

One common security problem caused by improper

Good error handling mechanisms should be able to

Examples and References

How to Determine If You Are

internal errors to occur and see how the site

Another valuable approach is to have a detailed

How to Protect Yourself

In the implementation, ensure that the site is built

Become a corporate supporter

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.