Displaying Error Codes In Production

[durangod]

Hi,

Usually when i display an error during my error display process i include a error code like so:




Notice it has a code at the end of the message. I did this during developement so i could track errors to a specific section of the project which makes it easier and faster to debug. In the beginning i also thought it would make it easier for users to report errors to site admins if they had a code.

But now i am thinking maybe i need to hide that code in production and only show that code if a debug config flag is set by admin. However, this would mean that to see the code, admin would need to set the flag for the site, then the user would need to duplicate their actions to see the code. I am wondering how users in general would feel about having to recreate the error to get a code.

As a user myself i dont mind seeing the codes but i am used to seeing them so my vote does not count. If it was someone elses software i would not care either, specific codes make things easier in general. But then i have to think about admins using the software, do they want codes read by public as a general rule.

It would be some work to add the debug flag to the project to block the code from showing, but if i am going to do it, now is the time before i build too many more pages. I do error_log some errors but since users dont have access to the error log i need to display the codes one way or the other. 🙂

How do you all feel about it? Should i just show the base message without the error code unless debug mode is on, or leave it as is?

Thanks 🙂

 

[arandombyte]

This is a great and very interesting question!
In my previous experiences, most end users don't mind, and they might even make note of the code that they see. However, from a security standpoint, this could be a very dangerous practice. Hackers can use these debug codes to find weak points and exploits in your code. You mentioned them as a "debug flag" and in my bug bounty days I would be looking for these all day long as they point to potential areas of exploit.

 

[durangod]

This is a great and very interesting question!
In my previous experiences, most end users don't mind, and they might even make note of the code that they see. However, from a security standpoint, this could be a very dangerous practice. Hackers can use these debug codes to find weak points and exploits in your code. You mentioned them as a "debug flag" and in my bug bounty days I would be looking for these all day long as they point to potential areas of exploit.

Thanks for the reply. Yes that was my thinking as well. Showing the codes to the public full time would open up a pathway. So yeah i think i will add a debug config flag if statement in the error messages to only show the code if the debug flag is set. That way admin can enable debug if there is a message and then turn it off when done. 🙂

The only positive now is that the script is ionCube protected and so they cant search the codes. But if they would ever be able to break ionCube for some reason then yes they could search and find the code section.

 

[arandombyte]

Thanks for the reply. Yes that was my thinking as well. Showing the codes to the public full time would open up a pathway. So yeah i think i will add a debug config flag if statement in the error messages to only show the code if the debug flag is set. That way admin can enable debug if there is a message and then turn it off when done. 🙂

The only positive now is that the script is ionCube protected and so they cant search the codes. But if they would ever be able to break ionCube for some reason then yes they could search and find the code section.

Sounds reasonable!