Improving Web Application Security: Threats and - CGISecurity

572 Part IV: Securing Your Network, Host, and ApplicationTracing is configured using the element. Set enabled=“false” on productionservers as follows:If you do need to trace problems with live applications, it is preferable that yousimulate the problem in a test environment, or if necessary, enable tracing and setlocalOnly=“true” to prevent trace details from being returned to remote clients.Exception ManagementDo not allow exception details to propagate from your Web applications back to theclient. A malicious user could use system-level diagnostic information to learn aboutyour application and probe for weaknesses to exploit in future attacks.The element can be used to configure custom, generic errormessages that should be returned to the client in the event of an application exceptioncondition. The error page should include a suitably generic error message, optionallywith additional support details. You can also use this element to return different errorpages depending on the exception condition.Make sure that the mode attribute is set to “On” and that you have specified adefault redirect page as shown below:The defaultRedirect attribute allows you to use a custom error page for yourapplication, which for example might include support contact details.Note Do not use mode=“Off” because it causes detailed error pages that contain system-levelinformation to be returned to the client.If you want separate error pages for different types of error, use one or more elements as shown below. In this example, “404 (not found)” errors are redirected toone page, “500 (internal system errors)” are directed to another page, and all othererrors are directed to the page specified on the defaultRedirect attribute.