4 ms·
Would be cool if it didn't leak half the authentication setup. Seems like the error handler could scan the text for configured values and mask before echoing it
by cabaalis 8y ago
Would be cool if it didn't leak half the authentication setup. Seems like the error handler could scan the text for configured values and mask before echoing it out.
- dannypgh 8y agoBetter yet, the error handler could not print anything back. A generic 500 is the way to go. Log your errors. If you think you'd get worthwhile bug reports / don't want to implement log analysis or whatever, take whatever errors, stack traces, etc. you'd like, encrypt and base64 encode them, and print that. Printing any hints about the nature of errors should be regarded as a security risk.
- cabaalis 8y agoAbsolutely true, and how I implement error handling personally (meaning give a friendly non technical message and track the error internally) I blame a brain collapse after a long day :)
- lurkertroll 8y agoCan't imagine scootertalk.org is attributing a lot of their resources to opsec