Difference between revisions of "Fail securely"

From OWASP
Jump to: navigation, search
Line 3: Line 3:
 
{{Template:Stub}}
 
{{Template:Stub}}
  
==Categories==
+
==Overview==
 +
 
 +
Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not.
 +
 
 +
For example:
 +
 
 +
isAdmin = true;
 +
try {
 +
  codeWhichMayFail();
 +
  isAdmin = isUserInRole( “Administrator” );
 +
}
 +
catch (Exception ex)
 +
{
 +
  log.write(ex.toString());
 +
}
 +
 
 +
If codeWhichMayFail() fails, the user is an admin by default. This is obviously a security risk.
  
 
[[Category:Principle]]
 
[[Category:Principle]]

Revision as of 09:51, 14 June 2006

This is a principle or a set of principles. To view all principles, please see the Principle Category page.

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.


Overview

Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not.

For example:

isAdmin = true; 
try { 
  codeWhichMayFail(); 
  isAdmin = isUserInRole( “Administrator” ); 
}
catch (Exception ex)
{
  log.write(ex.toString()); 
} 

If codeWhichMayFail() fails, the user is an admin by default. This is obviously a security risk.