OWASP Developer Guide

Handle all Errors and Exceptions Checklist

Home > Draft > design > web app checklist > handle errors and exceptions

4.2.10 Checklist: Handle all Errors and Exceptions

Handling exceptions and errors correctly is critical to making your code reliable and secure. Error and exception handling occurs in all areas of an application including critical business logic as well as security features and framework code.

Refer to proactive control C3: Validate all Input & Handle Exceptions and its cheatsheets for more context from the OWASP Top 10 Proactive Controls project, and use the list below as suggestions for a checklist that has been tailored for the individual project.

1. Errors and exceptions

  1. Manage exceptions in a centralized manner to avoid duplicated try/catch blocks in the code
  2. Ensure that all unexpected behavior is correctly handled inside the application
  3. Ensure that error messages displayed to users do not leak critical data, but are still verbose enough to enable the proper user response
  4. Ensure that exceptions logs give enough information for support, QA, forensics or incident response teams
  5. Carefully test and verify error handling code
  6. Do not disclose sensitive information in error responses, for example system details, session identifiers or account information
  7. Use error handlers that do not display debugging or stack trace information
  8. Implement generic error messages and use custom error pages
  9. The application should handle application errors and not rely on the server configuration
  10. Properly free allocated memory when error conditions occur
  11. Error handling logic associated with security controls should deny access by default

References

The OWASP Developer Guide is a community effort; if there is something that needs changing then submit an issue or edit on GitHub.

\newpage

Watch Star