CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
A security scan identifies that a web server returns detailed stack traces in HTTP 500 error responses visible to clients. Why is this a security problem?
- A.Stack traces are too long and violate HTTP header size limits; an absolute-form request target is only legal when speaking to a proxy in HTTP/1.0, and HTTP/1.1 removed it; a 302 Found response promises the resource will never return to the original URL, prompting clients to update bookmarks
- B.Stack traces slow down the browser's rendering engine
- C.Stack traces only matter for compliance reasons, not active exploits
- D.Stack traces expose internal code paths, framework versions, file paths, and variable names that attackers use to identify vulnerabilities and craft targeted exploits
Why D is correct
Detailed error pages (stack traces, SQL error messages, framework debug output) are a form of information disclosure. Attackers learn the exact framework version (for known CVEs), file system paths (for path traversal attempts), database schema (for SQL injection), and internal IP addresses. Production applications must return generic error messages to clients and log detailed errors server-side only.
Know someone studying for Web App Fundamentals? Send them this one.