ASP.NET Core Web API Interview Question #74

How should sensitive information be handled in API logs and error responses?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Do not expose secrets, access tokens, passwords, connection strings, stack traces, or unnecessary personal information in client-facing errors. Production errors should provide safe, useful ProblemDetails responses while detailed diagnostics remain in protected server-side telemetry.

Detailed Explanation

Logging should also avoid sensitive payloads by default. Structured logging and correlation identifiers help diagnose requests without copying entire confidential request or response bodies.

Code Example

return Problem(
    statusCode: StatusCodes.Status500InternalServerError,
    title: "An unexpected error occurred.",
    detail: "Use the trace identifier when contacting support.");

// Log the exception securely on the server,
// without exposing its stack trace to the client.