Improving Web Application Security: Threats and - CGISecurity

Chapter 7: Building Secure Assemblies 161Exception ManagementDo not reveal implementation details about your application in exception messagesreturned to the client. This information can help malicious users plan attacks on yourapplication. To provide proper exception management:●●●●●Use structured exception handling.Do not log sensitive data.Do not reveal system or sensitive application information.Consider exception filter issues.Consider an exception management framework.Use Structured Exception HandlingMicrosoft Visual C# and Microsoft Visual Basic .NET provide structured exceptionhandling constructs. C# provides the try / catch and finally construct. Protect code byplacing it inside try blocks and implement catch blocks to log and process exceptions.Also use the finally construct to ensure that critical system resources such asconnections are closed irrespective of whether an exception condition occurs.try{// Code that could throw an exception}catch (SomeExceptionType ex){// Code to handle the exception and log details to aid// problem diagnosis}finally{// This code is always run, regardless of whether or not// an exception occurred. Place clean up code in finally// blocks to ensure that resources are closed and/or released.}Use structured exception handling instead of returning error codes from methodsbecause it is easy to forget to check a return code and as a result fail to an insecuremode.