Improving Web Application Security: Threats and - CGISecurity

122 Part II:Designing Secure Web ApplicationsException ManagementExamine the way that your application handles error conditions. It is recommendedthat you consistently use structured exception handling. Also, check that yourapplication does not reveal too much information when an exception occurs.Table 5.9 shows the two major exception management vulnerabilities.Table 5.9 Common Exception Management VulnerabilitiesVulnerabilityFailing to use structuredexception handlingImplicationsYour application is more susceptible to denial of service attacksand logic flaws, which can expose security vulnerabilities.Revealing too much informationto the clientAn attacker can use this information to help plan and tunesubsequent attacks.Review the following questions to help ensure that your design is not susceptible toexception management security vulnerabilities:● Do you use structured exception handling?● Do you reveal too much information to the client?Do You Use Structured Exception Handling?Examine how your application uses structured exception handling. Your designshould mandate that structured exception handling be used consistently throughoutthe entire application. This creates more robust applications and your application isless likely to be left in inconsistent states that can reveal security vulnerabilities.Do You Reveal Too Much Information to the Client?Make sure that a malicious user cannot exploit the overly detailed information thatan error message contains. Review the following points:● Do you catch, handle, and log exceptions on the server?Make sure that the application does not let internal exception conditionspropagate beyond the application boundary. Exceptions should be caught andlogged on the server and, if necessary, generic error messages should be returnedto the client.● Do you use a centralized exception management system?The best way to handle and log exceptions consistently throughout yourapplication is to use a formalized exception management system. You can also tiethis system into monitoring systems that can be used by the operations team forhealth and performance monitoring.