Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generalize or remove stack trace information found in error message exception handling #29570

Open
douglaspalmer opened this issue May 15, 2024 · 0 comments
Labels
kind/enhancement Categorizes a PR related to an enhancement status/triage

Comments

@douglaspalmer
Copy link
Contributor

Description

A stack trace in an error page is a security risk as it reveals details of the system to an attacker.

Discussion

No response

Motivation

Security hardening.

Details

POST localhost:8080/admin/realms/master/clients-initial-access

with payload

{ "id": "test", "expiration" : 86400, "count": 1 }

and run this API , provided we do. not have client name as "test" on master realm The output will be
{ "error": "Unrecognized field "id" (class org.keycloak.representations.idm.ClientInitialAccessCreatePresentation), not marked as ignorable (2 known properties: "expiration", "count"])\n at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION disabled); line: 2, column: 12] (through reference chain: org.keycloak.representations.idm.ClientInitialAccessCreatePresentation["id"])", "error_description": "For more on this error consult the server log at the debug level." }

@douglaspalmer douglaspalmer added kind/enhancement Categorizes a PR related to an enhancement status/triage labels May 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement Categorizes a PR related to an enhancement status/triage
Projects
None yet
Development

No branches or pull requests

1 participant