How should an application handle an exception it did not anticipate?

Question

Accepted Answer

Catch it in a handler that returns controlled, generic output — never leaving it unhandled — A handler returning controlled output prevents crashes and information leaks (CWE-391) — the framework default exposes stack traces, writing the exception to the response leaks internals to the user, and blind retries can loop forever or mask a real fault.

Answer

Let it propagate to the framework's default handler — which shows a full stack-trace page

Answer

Write the raw exception into the response body — so the user can report the details back

Answer

Retry the failing operation over and over until it succeeds — hiding the error from view

How should an application handle an exception it did not anticipate?

Why this is the answer

More Secure Coding flashcards