Home / Knowledge hub / Secure error handling
Knowledge hub
Secure error handling
Failing safely and showing users nothing that helps an attacker.
What it means
Secure error handling is how an application behaves when something goes wrong. It does three things: stays safe when it fails, tells the user only what they need, and records the detail privately for the team. A failed payment should show a clear, plain message, not a database error. The same rule applies to API responses, background jobs and anything else that can fail.
Failing safely matters as much as the message. If an access check crashes, the app should deny the request, not skip the check and carry on. Security-critical code should deny first and explain later, so that a failure is never an invitation.
Why it matters
Errors are a source of free information. A message that says which part of a query failed, which file was missing or which software version is running saves an attacker hours of guessing. Different messages for a wrong user name and a wrong password let them list valid accounts, which feeds account enumeration. Even small differences, such as response time or wording, can leak the same information.
Poor handling also causes outright flaws. When an exception makes code skip a check, or leaves a half-finished transaction, you get access bypasses and inconsistent data. The cost shows up as an incident, not as a cosmetic bug. The fix is usually a small, central change, which makes it cheap to get right early.
How it shows up
You meet it in error pages, API error bodies, login and password reset messages, and logs. Frameworks usually have a global handler where the safe behaviour can be set once, with a short generic message for users and a reference ID that links to the log entry.
The mistakes repeat: returning stack traces to the client, catching an error and carrying on as if the check passed, and logging secrets or personal data along with the error. Check how your app behaves for bad input and for failures in its own dependencies. Related: debug mode left on.
Questions people ask
Secure error handling, answered
What should an error message tell the user?
What happened in plain words, what they can do next, and a reference they can give support. Nothing about internals.
Detailed causes belong in the server log.
What does fail closed mean?
If a security check cannot complete, because of a timeout or an exception, the request is refused. Failing open lets the request through, which an attacker can trigger on purpose.
Deny by default is the safer rule.
Should login errors say which part was wrong?
No. A single message such as incorrect email or password avoids confirming which accounts exist.
The same applies to password reset: respond the same way whether or not the account exists.
Is logging errors safe?
Yes, if the logs are protected and do not contain secrets, passwords or full personal data. Log enough to diagnose, no more.
Logs are often read by many people and tools, so treat them as sensitive.
How do we test error handling?
Send malformed input, missing parameters, wrong types and very large values, then read the responses and check the app still enforces access.
Also break a dependency in a test environment and see how the app behaves.
Sources
Where this comes from
Related
Terms that sit next to this one
Debug mode in production
Leaving developer switches on in a live app, which leaks internals.
Account enumeration
Learning which emails have accounts because your app answers differently.
Deny by default
Refusing every request unless a rule explicitly allows it.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Input validation
Checking that what arrives is the shape and range you expected.
What does a failure reveal?
We send bad input to the running app and read what comes back, then report leaks and bypasses we actually reproduced. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.