logo
Published on aidanf.net (http://www.aidanf.net)

Web applications shouldn't show exception traces!

By aidan
Created 2007-05-29 18:20

I encountered some problems when trying to book a ticket on the Citylink [1] Galway-Dublin Airport service. Tickets for this service must be booked in advance and the website is the most convenient way to do this.

Citylink exception 1Citylink exception 1

I got as far as entering my credit card details and the next step generated an exception (see screenshots). I tried again from scratch and got the same exception at the same point in the process. I was using Firefox on linux so I rebooted into windows and tried again using Internet Explorer. This time it worked.

Citylink exception 2Citylink exception 2

So there are a couple of possibilities:

The error trace mentions not being able to redirect so there may have been a problem with how the browsers handle redirects.

Regardless of the cause of the error this illustrates an important point about developing web applications - users should never see an exception trace. It’s an example of bad system design, especially when its at the stage of the process that processes your credit card. It shows that the code is not catching and handling exceptions and it exposes details of the applications internals to the outside world.

Exceptions should never be exposed to the public. When an exception occurs it should be caught and a http 500 error page with a friendly message should be displayed (I like customised 500 error pages: check out this example of reddit’s 500 page [2]). When an exception occurs it should also be logged so that developers can review it and fix any bugs that it shows up. For example you could have your exception handling code email you a stack trace with the current context whenever an exception occurs. I’m guessing that since they are not catching this error, they are not logging it so they probably don’t even know it occurred.


Source URL:
http://www.aidanf.net/blog/web-applications-shouldnt-show-exception-traces