Improving Web Application Security: Threats and - CGISecurity

162 Part III: Building Secure Web ApplicationsDo Not Log Sensitive DataThe rich exception details included in Exception objects are valuable to developersand attackers alike. Log details on the server by writing them to the event log to aidproblem diagnosis. Avoid logging sensitive or private data such as user passwords.Also make sure that exception details are not allowed to propagate beyond theapplication boundary to the client as described in the next topic.Do Not Reveal Sensitive System or Application InformationDo not reveal too much information to the caller. Exception details can includeoperating system and .NET Framework version numbers, method names, computernames, SQL command statements, connection strings, and other details that are veryuseful to attackers. Log detailed error messages at the server and return generic errormessages to the end user.In the context of an ASP.NET Web application or Web service, this can be done withthe appropriate configuration of the element. For more information,see Chapter 10, “Building Secure ASP.NET Web Pages and Controls.”Consider Exception Filter IssuesIf your code uses exception filters, your code is potentially vulnerable to securityissues because code in a filter higher up the call stack can run before code in a finallyblock. Make sure you do not rely on state changes in the finally block because thestate change will not occur before the exception filter executes. For example, considerthe following code:// Place this code into a C# class library projectpublic class SomeClass{public void SomeMethod(){try{// (1) Generate an exceptionConsole.WriteLine("1> About to encounter an exception condition");// Simulate an exceptionthrow new Exception("Some Exception");}// (3) The finally blockfinally{Console.WriteLine("3> Finally");}}}