in reply to Failing noticeably in CGI
Consider carefully the wisdom of doing so. Many of us don't use CGI::Carp on sites which will be exposed to the public because detailed information about how and why the code failed could be very helpful to an attacker who wished to compromise the site by deliberately causing it to fail and, perhaps, even help him engineer the means to cause it to fail in a specific manner for his advantage.
CGI::Carp is a handy development tool (especially when you don't have direct access to the server logs), but you'd probably be better off using a more verbose construct which lets you tell the user information which is both safe for you and useful for him1. Maybe even recover from the error and go on instead of dying. Something like:
unless (my $address = retrieve("/tmp/$session_file")) { warn "no session file $!\n"; create_new_session_file("/tmp/$session_file"); redirect_user_to('new_session_page'); }
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Failing noticeably in CGI
by WizardOfUz (Friar) on Nov 15, 2009 at 11:17 UTC | |
|
Re^2: Failing noticeably in CGI
by rastoboy (Monk) on Nov 16, 2009 at 07:02 UTC |