sus.botdocs

Security finding

A page shows a server error message or stack trace

Security Warning Severity: Medium

Part of the audit Information exposure. Finding id: security.errorTextOnPages.

What it costs you

Error output names file paths, database tables, library versions and sometimes a query with its values. A stranger learns how the site is built and where it breaks.

What to do

Show visitors a plain error page and write the details to a log. Then fix the error itself.

What it checks

  • Technical error details shown to visitors

How to fix it

Log PHP errors, do not show them

    How to check: Open [page url]: no error text. The message now appears in the PHP error log.

    Switch the application to production mode

    1. Turn off debug or development mode in the application's settings. Frameworks show stack traces only in that mode.
    2. Configure a plain error page for status 500.
    3. Fix the error shown on [page url]; the text says where it is.

    How to check: Open [page url]: no error text.