1. Computing

Programming Secure Web Applications in Python

From , former About.com Guide

6 of 10

Proper Error Handling

Errors live at the point where the computer is unsure of what to do. If the errors are left unchecked, the program either becomes unstable or terminates. If it is unstable, an attacker can exploit the lack of certainty and provide commands to be followed. If the application terminates prematurely, however, it may leave sensitive information open for exploitation.

Errors indicate the overall health of the executing process. It is imperatival to handle exceptions intelligently. All errors are not critical. Some can be allowed to pass silently (but explicitly!). It is therefore important to understand the health indicators of the executing process and to handle as critical those errors that are.

One need not declare every critical error to the user. Rather, it is often best to keep a logfile. If the error is sufficiently critical, one can simply scuttle the program, giving a polite, but not necessarily informative, error message to the user. Remember that any information you give a user in an error message can be used by an attacker to break into your program. Best to save critical information for a logfile.

  1. About.com
  2. Computing
  3. Python
  4. Web Development
  5. Secure Web Programming - Python Web Applications - Security Point Five - Proper Error Handling

©2013 About.com. All rights reserved.