error_handling

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Error handling objective: hide implementation details, log server-side

The goal of error handling is to return a generic response to users when unexpected errors occur, while logging the actual error details server-side for investigation. This prevents attackers from gathering technical information about the application stack during the reconnaissance phase of an attack.

Use 4xx errors for client-side issues, 5xx for server-side bugs

HTTP error codes should be chosen based on the source of the error: use 4xx error codes for requests that are due to an error on the part of the HTTP client (such as unauthorized access or request body too large), and use 5xx to indicate errors triggered on the server side due to unforeseen bugs. Applications should be monitored for 5xx errors which indicate the application failing for some sets of inputs.

RFC 7807 Problem Details for HTTP APIs

RFC 7807 defines a standard document format for error responses in REST APIs. The format allows API backends to return structured error information without revealing implementation details. Spring Framework 6 introduced support for this standard through the ProblemDetail class.

Java web.xml error handler configuration

For standard Java web applications using Servlet specification version 2.5 and above, global error handling can be configured in web.xml by adding an error-page element that maps exception-type java.lang.Exception to a location such as /error.jsp. This causes any unexpected error to redirect to the error page where details are logged and a generic response is returned.

Java error.jsp generic response implementation

In the error.jsp page, extract the exception using the implicit variable named 'exception', log it server-side, set response header 'X-ERROR: true' to indicate an error to the client, set HTTP status to 500, and return a generic JSON message such as '{"message":"An error occur, please retry"}' without revealing implementation details.

Spring Framework @ExceptionHandler global error handler

In SpringMVC or SpringBoot applications, create a class annotated with @RestControllerAdvice that extends ResponseEntityExceptionHandler and implements a method annotated with @ExceptionHandler(value = {Exception.class}). This method receives the exception and WebRequest, logs the exception server-side, and returns a ProblemDetail object created with ProblemDetail.forStatusAndDetail(HttpStatus.INTERNAL_SERVER_ERROR, 'An error occur, please retry').

Spring ProblemDetail content-type can be application/problem+json or application/problem+xml

When using Spring Framework's ProblemDetail class for error responses, the content-type header can be set to either 'application/problem+json' or 'application/problem+xml' depending on the desired format.

ASP.NET Core exception handler middleware configuration

In ASP.NET Core, configure a global error handler by calling app.UseExceptionHandler('/api/error') in the Configure method of Startup.cs, mapping exceptions to a dedicated API controller. In development environment, call app.UseDeveloperExceptionPage() to show debug pages. Use app.UseStatusCodePages('text/plain', 'Status code page, status code: {0}') to customize status code responses. This should be configured before other middlewares.

ASP.NET Core error controller implementation

Create an API controller with route 'api/[controller]', decorated with @AllowAnonymous. Implement handler methods for all HTTP verbs ([HttpGet], [HttpPost], [HttpHead], [HttpDelete], [HttpPut], [HttpOptions], [HttpPatch]). Extract the exception from HttpContext.Features.Get<IExceptionHandlerFeature>()?.Error, log it server-side, set response header 'X-ERROR: true', return a JsonResult with message 'An error occur, please retry', and set StatusCode to 500 (HttpStatusCode.InternalServerError).

ASP.NET Web API global error handler setup

In ASP.NET Web API (standard .NET Framework), define a class GlobalErrorLogger extending ExceptionLogger and a class GlobalErrorHandler extending ExceptionHandler. Register both in WebApiConfig.cs by calling config.Services.Replace(typeof(IExceptionLogger), new GlobalErrorLogger()) and config.Services.Replace(typeof(IExceptionHandler), new GlobalErrorHandler()). The logger logs exception details in its Log method, the handler sets a generic result in its Handle method.

ASP.NET Web API error response implementation

The GlobalErrorHandler in ASP.NET Web API should implement IHttpActionResult. In ExecuteAsync, create an HttpResponseMessage with HttpStatusCode.InternalServerError status, add header 'X-ERROR: true', set content to a JSON-serialized Dictionary with key 'message' and value 'An error occur, please retry', and set content type to 'application/json' with UTF-8 encoding.

ASP.NET Web.config customErrors configuration

In ASP.NET Web.config file within the system.web node, add a customErrors element with mode='RemoteOnly' (to show custom errors to remote clients only) and defaultRedirect attribute pointing to an error page such as '~/ErrorPages/Oops.aspx'.

Information disclosure risk: stack traces and error messages

Unhandled errors that expose stack traces, exception types, file paths, line numbers, or database error messages can assist attackers in the reconnaissance phase. Examples include revealing technology versions (Struts2, Tomcat), SQL injection points via database errors, and application installation paths. Error handling must prevent this disclosure.

Give your agent this brain