new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/error_handling

1 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Handling failed authorization checks

Failed access control checks are a normal occurrence in a secured application; consequently, developers must plan for such failures and handle them securely. Improper handling can leave the application in an unpredictable state (CWE-280: Improper Handling of Insufficient Permissions or Privileges). Specific recommendations include: (1) Ensure all exceptions and failed access control checks are handled no matter how unlikely they seem (OWASP Top Ten Proactive Controls C10: Handle all errors and exceptions). This does not mean an application should always try to 'correct' for a failed check; often a simple message or HTTP status code is all that is required. (2) Centralize the logic for handling failed access control checks. (3) Verify the handling of exceptions and authorization failures to ensure they do not put the software into an unstable state that could lead to authorization bypass. (4) Ensure sensitive information such as system logs or debugging output is not exposed in error messages, as misconfigured error messages can increase application attack surface (CWE-209: Generation of Error Message Containing Sensitive Information).

Give your agent this brain