API Testing · Middle · Question 26 of 75
Why is a database error message in an API response a security finding?
- 1It makes the response too large to send
- 2It reveals internals that help attackers
- 3Clients can't parse error messages at all
Show the answer
Correct answer: It reveals internals that help attackers
Explanation
Table names, SQL and stack traces should go to logs, not clients. The client gets a generic message and a correlation ID.