Error Handling Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:46:51Z

Point to the official site

2019-02-14T11:25:00Z

Migration to GitHub

2018-07-15T16:47:45Z

Add schema info

2018-07-15T16:44:15Z

Rewording

2018-07-15T16:39:32Z

Rewording

2018-07-15T16:36:36Z

Rewording

2018-07-15T16:34:16Z

‎Proposition

2018-07-15T12:10:22Z

Center image

2018-07-15T12:09:34Z

Rewording

2018-07-15T12:07:19Z

Rewording

← Older revision		Revision as of 14:46, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Error_Handling_Cheat_Sheet.md Error Handling Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html Error Handling Cheat Sheet] to see the latest version of the cheat sheet.

← Older revision		Revision as of 16:47, 15 July 2018
Line 64:		Line 64:

	The article show how to configure a global error handler at configuration level when possible otherwise at code level, in differents technologies, in order to ensure that if an unexpected error occur then a generic response is returned by the application but the error is traced on server side for investigation.		The article show how to configure a global error handler at configuration level when possible otherwise at code level, in differents technologies, in order to ensure that if an unexpected error occur then a generic response is returned by the application but the error is traced on server side for investigation.
		+
		+	The following schema show the target approach:

	[[File:ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png\|ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png\|center]]		[[File:ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png\|ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png\|center]]

@@ Line 257: / Line 257: @@
 == ASP.NET Web API web application ==
-With ASP.NET Web API, you can define and register handlers in order to trace and handle any error that occurs in the application.
+With ASP.NET Web API (from the standard .NET framework and not from the .NET Core framework), you can define and register handlers in order to trace and handle any error that occurs in the application.
 Definition of the handler for the tracing of the error details:

@@ Line 229: / Line 229: @@
+         {
              //First we configure the error handler middleware!
-             //We enable the global error handler in others environment that DEV because debug page are useful during implementation
+             //We enable the global error handler in others environments than DEV because debug page are useful during implementation
              //See https://docs.microsoft.com/en-us/aspnet/core/fundamentals/environments?view=aspnetcore-2.1 for technical details about Environment configuration
              if (env.IsDevelopment())

@@ Line 117: / Line 117: @@
 With SpringMVC or SpringBoot, you can define a global error handler by simply implementing this kind of class into your project.
-We indicate, via the annotation [https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/bind/annotation/ExceptionHandler.html ExceptionHandler], to the handler to act when any exception extending the class ''java.lang.Exception'' is throwed by the application.
+We indicate to the handler, via the annotation [https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/bind/annotation/ExceptionHandler.html @ExceptionHandler],  to act when any exception extending the class ''java.lang.Exception'' is throwed by the application.
 <syntaxhighlight lang="java">

@@ Line 73: / Line 73: @@
 = Proposition =
-For each technologies, a setup will be proposed with configuration and code snippet.
+For each technology, a setup will be proposed with configuration and code snippet.
 == Java classic web application ==
@@ Line 81: / Line 81: @@
 We propose here a configuration that can be used from Servlet specification ''version 2.5'' and above.
-With this configuration, any unexpected error will cause a redirection to the page '''error.jsp''' in which the error will be traced and a generic error response will be returned.
+With this configuration, any unexpected error will cause a redirection to the page '''error.jsp''' in which the error will be traced and a generic response will be returned.
 Configuration of the redirection into the '''web.xml''' file:
@@ Line 369: / Line 369: @@
 * https://exceptionnotfound.net/the-asp-net-web-api-exception-handling-pipeline-a-guided-tour/
 = Sources of the prototype =

@@ Line 65: / Line 65: @@
 The article show how to configure a global error handler at configuration level when possible otherwise at code level, in differents technologies, in order to ensure that if an unexpected error occur then a generic response is returned by the application but the error is traced on server side for investigation.
-[[File:ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png|ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png]]
+[[File:ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png|ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png|center]]
 As most of the recent application topology are ''API based'', we assume in this article that the backend expose only a REST API and do not contains any user interface content.

@@ Line 63: / Line 63: @@
 = Objective =
-The article show how to configure a global error handler at configuration level when possible otherwise at code level, in differents technologies, in order to ensure that if an unexpected error occur then a generic message is returned by the application but the error is traced on server side for investigation.
+The article show how to configure a global error handler at configuration level when possible otherwise at code level, in differents technologies, in order to ensure that if an unexpected error occur then a generic response is returned by the application but the error is traced on server side for investigation.
 [[File:ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png|ERROR_HANDLING_CHEAT_SHEET_OBJECTIVE.png]]
-As most of the recent application topology are "API based", we assume here that the backend expose only REST API and do not contains any user interface content.
+As most of the recent application topology are ''API based'', we assume in this article that the backend expose only a REST API and do not contains any user interface content.
-About the error logging operation itself, the [[Logging_Cheat_Sheet|logging cheat sheet]] should be used. This article will focus on the error handling part
+About the error logging operation itself, the [[Logging_Cheat_Sheet|logging cheat sheet]] should be used, this article will focus on the error handling part.
 = Proposition =

@@ Line 22: / Line 22: @@
 Issues at error handling level can reveal many information about the target and can be also used to identify injection point into the target's features.
-Example of disclosure of technologies stack, here Struts2 and Tomcat version, via an exception rendered to the user:
+Below is an example of disclosure of technologies stack, here Struts2 and Tomcat version, via an exception rendered to the user:
 <pre>
@@ Line 53: / Line 53: @@
 </pre>
-Example of disclosure of SQL query error, along the site installation path, that is useful to identify injection point:
+Below is an example of disclosure of SQL query error, along the site installation path, that is useful to identify injection point:
 <pre>