Thursday, June 4, 2015

Prevent logging sensitive data

Prevent logging to the user interface sensitive data, especially when you create a Web-shop, or the service is connected to a bank system, or your session is related to money.

Many cases you can find details about the system. These details are useful for hackers to create confusion in your service.



In this screenshot you can find many data about the service:
- used technologies
- version of the used framework
- transaction, session details: ids
- source code details, function names for example: btnPayWithCreditCard_Click()


If the exception is repeatable, the unfriendly user can analyze your service.

Better to create a simple error code, and if it occurs the proper service user, support team could check in the documentation how to get the details of the error.

No comments:

Post a Comment