Secure Coding Practices for Error Handling
Domain 8: Secure Coding Practices for Error Handling
This domain tests how the application behaves when something fails and what it reveals. The exam expects failures to be safe, useful to operators, and opaque to attackers.
Core rules and concepts
- Fail closed for security decisions. If an authorization or validation check errors, deny the action rather than continue.
- Return generic user-facing messages that do not reveal stack traces, SQL, file paths, internal hostnames, or whether an account exists.
- Log detailed diagnostic information internally with a correlation ID, timestamp, user or request context, and outcome. Never log passwords, tokens, session IDs, or full sensitive payloads.
- Catch exceptions at appropriate boundaries, clean up resources, and avoid swallowing errors silently.
- Use correct HTTP status codes and consistent error formats. Do not leak implementation detail through differing responses or timing.
- Separate user-facing errors from operational alerts; security-relevant failures should be monitored.
Worked example
A login handler catches a database exception and returns the raw exception text to the browser. An attacker learns the database type, query structure, and possibly account existence. A sound handler returns a generic message such as unable to process the request, logs the exception internally with a correlation ID, and alerts on repeated failures. The reasoning is that the user needs an actionable but non-sensitive message, while operators need the detail; the correlation ID links the two without exposing internals.
Traps that cost marks
Do not fail open when a check throws an exception. Do not return stack traces in production. Do not log credentials or session tokens. Do not use different error messages for valid and invalid usernames. Do not ignore exceptions that could leave data or permissions in an inconsistent state.
Review habit
For each error path, ask what the user sees, what the log records, what state remains, and whether the action was denied safely.