Blog

OWASP A10: Mishandling of Exceptional Conditions — Fail Closed and ProblemDetails

We start with a permission check that makes everyone an admin when the permission file cannot be read, a review endpoint that sends the SQL error and file path to the client, and a search that keeps running after the client has left. We fix them with fail closed, catching errors where they occur, IExceptionHandler and ProblemDetails, the .NET 10 handler logging change, request timeouts and cancellation.