This is an old subject, but one that's been bugging me.
When we disable Domain Checking (and I understand the reasons why we may want to) some of the pages involved will simply give us an unhandled error, usually "Page not found - vbscript error" or an exception in the .NET version.
Probably not a big deal, I just hate to see unhandled errors, even when users type in the browser command line something like "mydomain/forum/editpro.asp". I have no idea why anyone would do that, but it happens (bookmark maybe).
So, wouldn't it be good to add an additional request.form check in some of these pages (the ones that give us an unhandled error). Like, in the example of editpro.asp we could add a check for "forumID" as is already done with "jsenabled", like...
if request.form("forumID")="" then
response.clear
response.redirect ("goAway.asp")
response.end
end if
I just have a fear that some error message thrown up by the server might contain enough clues help hackers.
thanks, chief