Metadata

ID: csharp-security/avoid-debug-mode

Language: C#

Severity: Info

Category: Best Practices

Description

This rule ensures that the method UseDeveloperExceptionPage() is only called when debugging is enabled. The developer exception page provides detailed error information that can expose sensitive data and internal application details if shown in a production environment.

It is important to restrict the use of this page to development or debugging scenarios to prevent leaking potentially sensitive information to end users or attackers. Displaying detailed exception data in production can increase the risk of security vulnerabilities and negatively impact user experience.

To comply with this rule, wrap calls to UseDeveloperExceptionPage() inside conditional statements that check if debugging or development mode is active. For example, use if (enableDebug) { app.UseDeveloperExceptionPage(); } to ensure the exception page is only enabled when appropriate. This practice helps maintain application security and stability across different environments.

Non-Compliant Code Examples

app.UseDeveloperExceptionPage();

Compliant Code Examples

if (enableDebug) {
    app.UseDeveloperExceptionPage();
}

switch (foo) {
    case "bar":
        app.UseDeveloperExceptionPage();
        break;
}