From a security perspective is ok to write out the error from a ajax call?

Martin Cooke 0
Viewed 15

My ajax calls typically go something like this:

$.ajax({
                    type: 'POST',
                    url: '/Controller/GoDoWhatever',
                    contentType: 'application/json;',
                    data: JSON.stringify(obj),
                    success: function (data) {
                        // all good
                    },
                    error: function (error) {
                        console.log(error);
                    }
                });

What I'd like to know is when we do hit an error what is ok or not ok to do with error? Once code goes live the console.log only serves a purpose to a developer really imo. However, can potentially personal data brought back from the error say if I've wrote the controller in an insecure way. If there is a chance the error can give a nefarious user an edge then what should I be doing, not console.log at all or completely remove the error functionality? Hope I've explained this correctly, thanks in advance :)

error-handling ajax security jquery javascript
1 Answers

Users can access it through devtools anyway. Doesn't matter if you console.log it or not.

Make sure the server sends safe error messages, then anything you do with it will be safe.

Public APIs obviously should have safe messages, and you should handle errors (and send a safe error back to the client) for all API routes in your own server.

Angshu310
Related