When your application displays error messages, it should not give away information that a malicious user might find helpful in attacking your system. For example, if your application unsuccessfully tries to log in to a database, it should not display an error message that includes the user name it is using.

There are a number of ways to control error messages, including the following:

Configure the application not to show verbose error messages to remote users. (Remote users are those who are not requesting pages while working on the Web server computer.) You can optionally redirect errors to an application page.
Include error handling whenever practical and construct your own error messages. In your error handler, you can test to see whether the user is local and react accordingly.
Create a global error handler at the page or application level that catches all unhandled exceptions and routes them to a generic error page. That way, even if you did not anticipate a problem, at least users will not see an exception page.

To configure the application to turn off errors for remote users

In the Web.config file for your application, make the following changes to the customErrors element:

Set the mode attribute to RemoteOnly (case-sensitive). This configures the application to show detailed errors only to local users (that is, to you, the developer).
Optionally include a defaultRedirect attribute that points to an application error page.
Optionally include <error> elements that redirect specific errors to specific pages. For example, you can redirect standard 404 errors (page not found) to your own application page.

The following code example shows a typical customErrors block in the Web.config file.

В	Copy Code
<customErrors mode="RemoteOnly" defaultRedirect="AppErrors.aspx"> <error statusCode="404" redirect="NoSuchPage.aspx"/> <error statusCode="403" redirect="NoAccessAllowed.aspx"/> </customErrors>

To include error handling

Use a try-catch block around any statements that might generate errors.

Optionally, test for a local user with the IsLocal property and modify error handling accordingly. The value 127.0.0.1 is equivalent to localhost and indicates that the browser is on the same computer as the Web server.

The following code example shows an error-handling block. If an error occurs, a session state variable is loaded with details about the message, and the application then displays a page that can read the Session variable and display the error. (The error is deliberately written to provide no exploitable details to the user.) If the user is local, different error details are provided. In the finally block, an open resource is released.

Visual BasicВ	Copy Code
Try SqlConnection1.Open() SqlDataAdapter1.Fill(Me.DsPubs1) Catch ex As Exception If Request.IsLocal Then Session("CurrentError") = ex.Message Else Session("CurrentError") = "Error processing page." End If Server.Transfer("ApplicationError.aspx") Finally SqlConnection1.Close() End Try

Visual BasicВ

Copy Code

Try
   SqlConnection1.Open()
   SqlDataAdapter1.Fill(Me.DsPubs1)
Catch ex As Exception
   If Request.IsLocal Then
      Session("CurrentError") = ex.Message
    Else
      Session("CurrentError") = "Error processing page."
    End If
    Server.Transfer("ApplicationError.aspx")
Finally
       SqlConnection1.Close()
End Try

C#В	Copy Code
try { sqlConnection1.Open(); sqlDataAdapter1.Fill(dsCustomers1); } catch (Exception ex) { if(Request.IsLocal) { Session["CurrentError"] = ex.Message; } else { Session["CurrentError"] = "Error processing page."; } Server.Transfer("ApplicationError.aspx"); } finally { this.sqlConnection1.Close(); }

C#В

Copy Code

try
{
    sqlConnection1.Open();
    sqlDataAdapter1.Fill(dsCustomers1);
}
catch (Exception ex)
{
    if(Request.IsLocal)
    { Session["CurrentError"] = ex.Message; }
    else
    { Session["CurrentError"] = "Error processing page."; }
    Server.Transfer("ApplicationError.aspx");
}
finally 
{
    this.sqlConnection1.Close();
}

Creating a Global Error Handler

You can also create an error handler that catches all unhandled exceptions at the page level or for the application as a whole.

To create a global error handler

To create a global handler in a page, create a handler for the System.Web.UI.TemplateControl.Error event. To create an application-wide error handler, in the Global.asax file, add code to the System.Web.HttpApplication.Error event. These methods are called if an unhandled exception occurs anywhere in your page or application, respectively. You can get information about the most recent error from the GetLastError method.

Note
If you have a global error handler, it takes precedence over error handling specified in the defaultRedirect attribute of the customErrors configuration element.

The following code example shows a handler that gets information about the current error, puts it into a Session variable, and then calls a generic error-handling page that can extract and display the error information.

Visual BasicВ	Copy Code
Sub Application_Error(ByVal sender As Object, ByVal e As EventArgs) Session("CurrentError") = "Global: " & _ Server.GetLastError.Message Server.Transfer("lasterr.aspx") End Sub

C#В	Copy Code
protected void Application_Error(Object sender, EventArgs e) { Session["CurrentError"] = "Global: " + Server.GetLastError().Message; Server.Transfer("lasterr.aspx"); }

To configure the application to turn off errors for remote users

To include error handling

Creating a Global Error Handler

To create a global error handler

See Also

Other Resources