Home/ Questions/Q 888507
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T13:24:34+00:00

I keep reading that an ASP.NET based web site should have custom errors enabled

  • 0

I keep reading that an ASP.NET based web site should have custom errors enabled in the web.config because exceptions will show a stack trace.

I may have a faulty memory (currently don’t have access to an ASP.NET website under development), but I thought as long as Compilation debug=”false” in the web.config file, then the stack trace will not be displayed.

Is my understanding correct about the debug flag and display of the stack trace? If so, then even if custom errors are not enabled, then won’t the only message displayed to remote users for an exception be a the non-descriptive message:

“The page cannot be displayed because an internal server error has occurred.”

If so then wouldn’t it be OK, from a security perspective, to not display a custom error page for the exception?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No, a stack trace will still be shown even if the debug flag is off, but it will not have line numbers for each call in the stack.

    The non-descriptive message is what the browser usually shows instead of the actual error message from the server, unless you change the configuration. Anyone wanting to expose information by causing error messages would know how to do this.

    Displaying the stack trace isn’t a security risk in itself, but it does expose some information that could potentially make it easier to hack the site. A hacker might for example get a clue as to what’s done to sanitase the input and find a way around it.

    • 0