PHP Exceptions and Security

Question

When in a page triggered by an exception, what vulnerabilities is a php page open to?

I am using Kohana and am used to triggering exceptions (404, runtimes, etc)

But I recently read a book (19 Sins in Software Security) that says a site in an unstable state(i.e. in an page triggered by exception) is open to critical attacks.

I am worried because most of the time I am throwing 404 exceptions if a page is not allowed to be accessed or another exception if parameters passed to functions are not of the expected type.

Answer 1

If a page is not allowed to be accessed, you should send the 403 forbidden header istead of the 404 not found.

Exceptions open a site to no special vulnerabilities - but frequent throwing of Exceptions are a hint that your code is suboptimal and unstable. Remember: Exceptions are the last straw you have, not the first solution you should consider.

Answer 2

In your case, it sounds like the exceptions you are using present no particular security vunerabilities.

However, they can if error_reporting is set to on (it shouldn't be in production, but if it was..) in that the default exception output presents a backtrace. A good example of this is that when connecting to your DB, if you are using PDO with exceptions on and the connection fails a PDO exception is thrown, whoose default output contains the arguments provided to the PDO object (i.e. you db name and password).