ASP.NET Custom Errors vs. Compilation debug="false" and security

Question

I keep reading that an ASP.NET based web site should have custom errors enabled in the web.config because exceptions will show a stack trace.

I may have a faulty memory (currently don't have access to an ASP.NET website under development), but I thought as long as Compilation debug="false" in the web.config file, then the stack trace will not be displayed.

Is my understanding correct about the debug flag and display of the stack trace? If so, then even if custom errors are not enabled, then won't the only message displayed to remote users for an exception be a the non-descriptive message:

"The page cannot be displayed because an internal server error has occurred."

If so then wouldn't it be OK, from a security perspective, to not display a custom error page for the exception?

Answer 1

No, a stack trace will still be shown even if the debug flag is off, but it will not have line numbers for each call in the stack.

The non-descriptive message is what the browser usually shows instead of the actual error message from the server, unless you change the configuration. Anyone wanting to expose information by causing error messages would know how to do this.

Displaying the stack trace isn't a security risk in itself, but it does expose some information that could potentially make it easier to hack the site. A hacker might for example get a clue as to what's done to sanitase the input and find a way around it.

Answer 2

Custom error messages should almost always be prefered over the default error thrown. It gracefully sends your user to a location where they can keep browsing your site without having to go back and try again.

Turning DEBUGGING off in your web.Config is VERY important and goes beyond just not showing the line numbers and stack trace... it also tells the compiler to build in release mode which optimizes performance dramatically. As soon as your app goes to production, all debugging should be disabled.