CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A Node.js API uses Express.js and returns unhandled promise rejections as JSON error responses including the error stack trace. Why is returning stack traces to clients dangerous?
- A.Stack traces increase response payload size
- B.Stack traces reveal internal file paths, function names, library versions, and code structure that attackers use to identify vulnerable library versions (CVEs), map the codebase, and craft targeted exploits
- C.Stack traces cause memory leaks in Node.js
- D.Stack traces violate GDPR because they contain user data
Why B is correct
Stack traces are rich information-disclosure: they expose absolute file system paths (revealing deployment structure), Node.js version (CVE lookup), npm package names and versions (CVE lookup), function call chains (code logic), and sometimes variable values. The OWASP principle is: log detailed errors server-side, return generic error messages to clients. Express.js's default error handler includes stack traces in development but should be overridden in production.
Know someone studying for Web App Fundamentals? Send them this one.