Two people read your error message
Every error message has two readers with opposing needs:
| Reader | Needs |
|---|---|
| A user or integrating developer | Enough to fix their own request |
| An attacker | Anything about the system's internals |
The resolution is not picking a side but noticing those needs want two different kinds of information:
- A user needs to know what in their request was wrong — which field, which rule.
- An attacker wants to know what the system is built from and what is inside it — framework, version, table names, file paths, internal hostnames.
Those two sets barely overlap, so you can give the first without the second.
Four things commonly leaked, each handing over a piece of the map:
| Leaked | What it tells an attacker |
|---|---|
| A stack trace | Framework, version, directory layout, internal class names, whether debug symbols ship |
| A raw database error | The DB engine, table names, column names, and a channel for error-based SQL injection |
| An absolute file path | The OS, the process user, the container layout |
| Different messages for the same action | See account-enumeration — each difference is a bit |
The second row deserves emphasis: a raw database error does not merely disclose schema, it turns blind SQL injection into error-based SQL injection. The attacker no longer infers from response timing; they read a message stating exactly where their query was malformed, and that cuts exploitation from hours to minutes.
And the resolution of the conflict: a correlation id. Return a traceId, log everything against it, and tell the user "give this to support". The user has a way forward, support has the full picture, and the attacker receives a GUID.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…