3 ms·
Unless "table does not exist" does take precisely the same time as “access denied” you still leak the same information by replacing the latter. For logged in u
by lixtra 5y ago
Unless "table does not exist" does take precisely the same time as “access denied” you still leak the same information by replacing the latter.
For logged in users I would prefer logging with explicit error messages. Like that you can tell if someone is poking around or was hacked. And still get clear error messages.
- uberman 5y agoSure, if "table does not exist" actually means that, which it does not. It means you have no access to such a table if it exists or not