SecLab
Logging, Error Handling & ResponsewalkthroughDifficulty 2/523 min

Returning errors without drawing the map

Objective: After this lesson you can design an error response detailed enough for a user to fix and not enough for an attacker to probe.

V16CWE-200A10:2025info-disclosure
Step 1 of 5 · read5 min

Two people read your error message

Every error message has two readers with opposing needs:

ReaderNeeds
A user or integrating developerEnough to fix their own request
An attackerAnything about the system's internals

The resolution is not picking a side but noticing those needs want two different kinds of information:

  • A user needs to know what in their request was wrong — which field, which rule.
  • An attacker wants to know what the system is built from and what is inside it — framework, version, table names, file paths, internal hostnames.

Those two sets barely overlap, so you can give the first without the second.

Four things commonly leaked, each handing over a piece of the map:

LeakedWhat it tells an attacker
A stack traceFramework, version, directory layout, internal class names, whether debug symbols ship
A raw database errorThe DB engine, table names, column names, and a channel for error-based SQL injection
An absolute file pathThe OS, the process user, the container layout
Different messages for the same actionSee account-enumeration — each difference is a bit

The second row deserves emphasis: a raw database error does not merely disclose schema, it turns blind SQL injection into error-based SQL injection. The attacker no longer infers from response timing; they read a message stating exactly where their query was malformed, and that cuts exploitation from hours to minutes.

And the resolution of the conflict: a correlation id. Return a traceId, log everything against it, and tell the user "give this to support". The user has a way forward, support has the full picture, and the attacker receives a GUID.

View path

Comments

Join the discussion
Sign up to comment

Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.

Sign upSign in

You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.

Loading comments…