Secure Error Handling for C# Applications

Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

Before you write any code, it's important to understand why secure error handling matters in production APIs. In this challenge, you'll explore key risks: unhandled exceptions that expose stack traces, verbose logs that may leak sensitive information, and differences between Development and Production environments.

You'll create a basic ASP.NET Core Web API with a /login endpoint that intentionally throws an exception when a password check fails. You'll observe how the framework exposes stack traces and input by default in both Development and Production modes—and why that's insecure without added protections.

You'll create global exception-handling middleware to catch unhandled exceptions and return a safe JSON error response. You'll then ensure full exception details are logged internally and that behavior remains consistent across Development and Production environments.

You’ll integrate Serilog to produce structured, queryable logs. You’ll configure a JSON file sink, replace Console.WriteLine with Serilog calls, and add masking logic to prevent sensitive data like passwords and tokens from being stored.

To finish the lab, you will answer some assessment questions that will test your understanding of the concepts you learned throughout this lab.