YanoSecWhen a request fails, visitors need a useful message while operators may need diagnostic detail. Information disclosure occurs when information crosses into an audience that should not receive it. An API secret is authentication material used by software; it does not belong in a public error or ordinary diagnostic log.
A stack trace lists the program calls involved in reaching an error. File paths and traces can expose internal structure, but the sensitivity of each detail depends on context. A reference identifier lets a visitor report an error while an operator locates the matching restricted diagnostic record.
Before you begin
- Recommended first
- Notes: scope, command, result, time, HTTP methods, headers, status codes, cookies, How a web app is put together, Same-origin policy, Business logic
- Estimated time
- 16 min reading, 12 min activity. Setup and optional practice may take longer.
- Where you work
- Read the original fictional requests, source fragments and state tables in a current desktop or mobile browser. The required activity needs no server, database, account or installed security tool. Do not send the printed requests to any service.
- Without a lab
- Use the complete printed evidence to trace the data or state on paper. Write the decision, the fact supporting it and one limit of the model, then compare with the activity rubric. This does not establish live service behavior. Reading works without JavaScript. Checking requires JavaScript and a secure browser context; saving also requires usable browser storage.
After this lesson you can:
- Separate the public body from the operator log.
- Rewrite the Q-19 public body so it keeps the reference only.
- Leave the fictional token untested.
01Example
This fresh fictional diagnostic uses a reference without copying authentication material. Compare its audience with the separate Q-19 activity.
Public: Request failed. Reference R-880.
Restricted diagnostic: R-880; operation save-note; validation failed.
Secret: omitted from both records.
Model only; no request was sent.02Two audiences
Compare the audience of each response. A public body should give a safe message and a reference identifier. Restricted diagnostics may record useful technical context with appropriate access and retention controls. They should still omit or redact secrets. The supplied historical log card deliberately contains fictional values; restricted access is not a reason to copy that pattern into production.
The boundary is the application's internal state becoming a public response. Remove sensitive detail at that boundary and keep authentication material out of logs. If a real secret has been exposed, notify its owner through the agreed process so it can be revoked or rotated. An error or version banner alone does not prove a further exploitable vulnerability.
Keep public errors useful with a reference identifier, and omit authentication secrets from public responses and diagnostic logs.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
| Field | Public response | Restricted diagnostic |
|---|---|---|
| Audience | Public | Restricted |
| Correlation reference | R-880 | R-880 |
| Visible content | Request failed. Reference R-880. | operation save-note; validation failed |
| Secret | Omitted | Omitted |
R-880 links the public and restricted records without copying all diagnostic details.
R-880 links the public and restricted records without copying all diagnostic details.
Follow the explanation
- R-880 links the public and restricted records without copying all diagnostic details.
- The restricted record carries internal detail. Neither record includes a secret or an observed request.
Read every state and value
1. R-880 links the public and restricted records without copying all diagnostic details.
- Selected Comparison
- same
- Highlighted Field
- Correlation reference
2. The restricted record carries internal detail. Neither record includes a secret or an observed request.
- Selected Comparison
- different
- Highlighted Field
- Audience · Visible content · Secret
03Rewrite the Q-19 public line
Read the evidence before comparing your reasoning with the activity rubric. Do not paste the fictional token into another site.
Public response model. The secret below is fictional and is not a credential.
status: 500
body: reference Q-19; token demo-token-amber; file /lab/app/pay.py line 40
Worked public body, different reference:
status: 500
body: reference R-441; key club-demo-key-not-real; file /lab/app/pay.py line 12
Corrective rule: retain a safe message and reference in the public response. Omit or redact secrets from restricted diagnostics too.
Historical fictional diagnostic model, deliberately retaining placeholder secrets.
Restricted access does not make recording a secret appropriate. In a corrected log, omit or redact authentication material.
The values below are not credentials and must not be tried.
R-441 key club-demo-key-not-real location /lab/app/pay.py:12
Q-19 token demo-token-amber location /lab/app/pay.py:40
Public copy that matches the rule:
R-441
Q-19
The public copy keeps the reference and omits the key, the token, and the file path.
- Find Q-19 in the public model and identify the reference, placeholder token and internal path.
- Draft a public message retaining the reference without the token or path.
- Compare your message with this rubric: Q-19 remains available for reporting, sensitive detail is absent, and the token is omitted or redacted from any diagnostic copy too.
- Stop at the printed evidence. Do not test the fictional token.
04Optional challenge
Say what to do if a real secret appeared in a public error, without writing the secret down. The rubric is: tell the owner, revoke it, and keep it out of your notes. About ten minutes.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Disclosure case A: new fictional errorOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Public response: reference L-72; token imaginary-lime-not-real; file /srv/demo/store.py line 27.
Operator detail: save-note validation failure for reference L-72.
The token is a fictional placeholder, not a credential. Do not test it.
Policy: public bodies keep a safe message and reference only; restricted logs may retain needed technical context, but must omit or redact secrets.
06Explain your evidence
Optional written self-check: explain one decision using the supplied case. No tool run is required.
Check your explanation: separate public and restricted audiences; keep the reference without exposing internal paths or secrets; explain what was shown without claiming any further exploit; describe redaction and an owner notification for real exposed secrets.
07Common mistakes
If the public line still contains demo-token-amber, you copied the model instead of the rule.
If you delete the reference as well, operators lose the handle that ties the public report to the log.
If you try the fictional key, you left the lesson. It is not a credential.
References
- PortSwigger: Information disclosure
Explains the failure mechanism and prevention. Use it for further reading after reasoning from this page's original model; a topic page is not evidence that a lab was launched.