Secure Error Handling and Security Logging

Two related OWASP risks are about what happens when things go wrong: whether your app fails safely, and whether anyone notices an attack in progress.

Fail closed

When an error happens during a security decision, the safe default is "deny".

// Dangerous: an error in the permission service grants access
async function canEdit(user, doc) {
  try {
    return await permissions.check(user.id, doc.id, 'edit');
  } catch {
    return true;     // fails open
  }
}

// Safe
async function canEdit(user, doc) {
  try {
    return await permissions.check(user.id, doc.id, 'edit');
  } catch (err) {
    logger.error({ err, userId: user.id, docId: doc.id }, 'permission check failed');
    return false;    // fails closed
  }
}

Handle the unusual cases deliberately

• Timeouts and partial failures in multi-step operations: use transactions or compensating steps so data isn't left half-updated.
• Unexpected input types and sizes: validate and reject early.
• Resource exhaustion: limits on uploads, request bodies, query complexity and loops.

Don't leak details

• Users see a generic message and a request ID; details go to logs.
• Login errors say "invalid email or password", not which one was wrong.
• Password reset says "if the account exists, we've sent an email".

Log security events

Record events you'd need to investigate an incident:

• Logins (success and failure), logouts, MFA changes, password resets.
• Permission denials and access to sensitive records.
• Admin actions and configuration changes.
• Input validation failures that look like attacks (many in a row from one source).

securityLog.info({
  event: 'login_failed',
  email: hashForLogs(email),     // avoid storing raw personal data where you can
  ip: req.ip,
  userAgent: req.get('user-agent'),
  reason: 'bad_password',
});

Make logs useful

• Never log passwords, tokens, full card numbers or session IDs.
• Ship logs off the server so an attacker can't quietly delete them.
• Alert on patterns: bursts of failed logins, one account accessed from many countries, spikes in 403s.
• Keep audit logs long enough for investigations (often a year or more for important systems).