Improving Web Application Security: Threats and - CGISecurity

294 Part III: Building Secure Web ApplicationsThe error page should include a suitably generic error message, possibly withadditional support details. The name of the page that generated the error is passed tothe error page through the aspxerrorpath query parameter.You can also use multiple error pages for different types of errors. For example:For individual pages you can supply an error page using the following page-levelattribute:Implement Page-Level or Application-Level Error HandlersIf you need to trap and process unhandled exceptions at the page level, create ahandler for the Page_Error event that is similar to the one shown below.public void Page_Error(object sender,EventArgs e){// Get the source exception detailsException ex = Server.GetLastError();// Write the details to the event log for diagnostics. . .// Prevent the exception from propagating and generating an// application level event (Application.Error)Server.ClearError();}If exceptions are allowed to propagate from the page handler or there is no pagehandler, an application error event is raised. To trap application-level events,implement Application_Error in Global.asax, as follows:protected void Application_Error(Object sender, EventArgs e){// Write to the event log.}