An error message is a message.
You wrote it for a teammate at three in the morning.
It is being read by someone
running a script against your login page.
Both of them get the same words.
A stack trace is generous.
It names your framework,
your version,
your directory layout,
the driver talking to your database,
and now and then the query itself.
You have handed a stranger
the floor plan of a building
you asked them not to enter.
Then there is the polite one.
"No account with that email address."
Kind. Helpful. Wrong.
A stranger can now ask your login page
which of ten thousand addresses
belong to real people,
one request at a time,
and it will answer honestly all day
without ever raising its voice.
The same trick works
with no words at all.
If a wrong password takes
two hundred milliseconds
and an unknown user takes twenty,
the clock is the message.
You have to be boring
in exactly the same way
for both.
The rule is easy to say
and annoying to keep.
Say the same thing to everyone outside.
Say everything inside.
Outside: one short line,
no detail,
and a reference number.
Inside: the trace, the query, the identifiers,
the whole story, in the logs,
findable by that number in one search.
Then the person who needs the detail
has all of it,
and the person who was fishing
gets a flat sentence
and a number that means nothing to them.
Two more, while you are here.
"Access denied" on a record
that does not exist
has just told the reader it exists.
And returning a 404
where a 403 would be honest
is not a lie you owe anyone an apology for.
Go and read your own errors
the way an outsider reads them.
No goodwill.
Plenty of time.
That is the audience
you actually wrote them for.
– Serguey Asael Shinder
Top comments (0)