On stack traces and webapps

January 20, 2014

IMO, many web app stack traces have a special place in hell. Here is why:

Stack traces are scary. The info it contains rarely helps the average non tech person. Of course these traces are targeted at the sysadmin or developer.
The info it contains can be very extensive, sometimes exposing info it would be more difficult to extract from the machine otherwise. In fact, a stack trace can potentially help a malicious person.
As such, I believe that stack traces should be written elsewhere. Be it database or log. It is to the developer to decide.
Then, just have the webserver return the error UID with instructions to contact admin. Said admin will be able to go in and get the actual info from the trace.
Of course, I understand that when you are developing you want the info quickly… but please… make it a config parameter, a flag, whatever!
Just dont put a Stack Trace there!