API Design · Middle · Question 62 of 75

What's the risk of exposing internal error messages (e.g. SQL errors) to API clients?

1They make responses slower
✓Correct answer: They leak implementation details that help attackers; log them internally and return generic messages with a correlation ID
3Clients can't display them

Explanation

Security misconfiguration (OWASP API8) includes verbose error messages.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.