Update: Authorization_Cheat_Sheet.md

[brandonaltermatt]

What is missing or needs to be updated?

The section in the authorization cheat sheet that discusses access control error handling should be supplemented with a warning not to surface sensitive information in error messages. This is a relatively common vulnerability, and it belongs in a high-level description of proper error handling for authorization failures.

How should this be resolved?

A single bullet point addressing this vulnerability with a link to the CWE (here) would be enough to bring this to the attention of readers. E.g:

• Ensure sensitive information, such as system logs or debugging output, is not exposed in error messages. Misconfigured error messages can increase the attack surface of your application. (CWE-209: Generation of Error Message Containing Sensitive Information)

[jmanico]

+1 I like this idea. Do you want to PR for us?

[brandonaltermatt]

Sure thing, I can put out a PR shortly.