3 ms·
The recommended temporary patch is horrible. They want servers to return 500 error with exactly the same message no matter what the problem is. That means 404 a
by MichaelApproved 16y ago
The recommended temporary patch is horrible. They want servers to return 500 error with exactly the same message no matter what the problem is. That means 404 and any other custom error can't be returned to the user. The user has no idea what just happened and why they're seeing the error.
A patch is on the way to eventually make this unnecessary but there's absolutely no ETA for it. Are we talking days, weeks, (gasp) months? They do deserve credit for responding to the comments but it would be good to have a better ETA.
- jasonkester 16y agoThe article is a bit vague there, bit I didn't read it to mean you couldn't distinguish 404s from 500s. It seems to say that you shouldn't tell people which flavor of 5xx he got, since that's useful info to an attacker. As I mentioned in another thread, this doesn't seem like it would affect any real sites, so it's not a case of waiting for (gasp) months for a patch while your server is in real jeopardy. Security warnings like this come through for ASP.NET a couple times a year, but nearly all of them are of the "don't do the stuff you already shouldn't be doing, or bad things might happen" variety.
- MichaelApproved 16y agoThe 404 restriction is driven home in the comments. Many users ask and its repeated several times that all errors should be 500, even 404.