specific vs generic error messages

Question

So in this site we have an array of error messages. In the case something goes wrong, we pick the specific error message show it to the user. There are many instances where the error should occur only when someone tries something naughty, like change something in the URL in hope that he can access someone else's resources. We are trapping this in the backend so all is good.

My question is, when a scenario like that happens, should we show a specific error message like Sorry, you do not have permission to access that resource or a generic error like An unexpected error occurred.

What do you think you would prefer as an user.

Answer 1

The purpose of an error message is to help the user who encountered it, to learn how to avoid the behavior that caused the problem. The program has encountered a situation that it can not handle, and needs to tell the user, so that the user (or someone else) can arrange to avoid the situation that the program can not handle.

The error an unexpected error occurred is entirely useless in this goal. It give the user no hint about what might be changed in order to avoid the problem.

I don't believe it is possible in general for the program to determine the motive of the user when the problem was encountered. You might think that the situation happens only when the user is being naughty, but if the same problem occurs due to an unanticipated combination of things, and you display a you were naughty message, the user might be quite incensed and rightly so!

Programs are hard enough to use, that every error message should use every change to give as clear an explanation of what it can't handle. The message you do not have access right to that resource is clear and to the point. Maybe the user was manipulating the URL (is that a crime?) But maybe their access rights were set up incorrectly. Or maybe their rights have changed since they favorited the URL. Or maybe there is a programming error that caused them to get there by no means of their own. As the program is modified in the future, you can not anticipate today what situations the user might encounter. In many of these cases, letting the user know that it is a rights problem might lead them to resolve the problem -- and then everyone wins.

Because of all this, you give a clear, accurate description of what situation it is that the routine can not handle, and report that to the user. You users will thank you for that in the long run.

I have written quite a bit more on this in a blog post: http://agiletribe.wordpress.com/2013/08/24/error-message-should-be-clear-plain-and-direct/

Answer 2

What I would consider most important would be what should happen if a clueless user accidentally stumbles upon an unusual but important flaw in your system. If he or she produces an incorrect result after a series of steps that could potentially be difficult to recreate, you don't want to further complicate the debugging process by giving them a cryptic error message.

Help your users out by informing them why the system has failed under these circumstances, and if they still aren't satisfied, you'll be happier when they come crying to you because your team will be more likely to track down a You don't have the permission to access this content message rather than a Sorry! An error occurred message. As long as your site is secure, you should be worrying about the experience your normal users will be having, not about hackers.

Answer 3

Since your question invites us to share what we would personally prefer, my favorite ones are those that :

• remain friendly, i.e. not too apologetic but strong and friendly at the same time, e.g. those that will say "We're afraid something went wrong..." in a way that does not mean "We're sooo sorry, something broke because we are real dummies... Soooorry..." but rather "These things happen, even to the best ones. Now let's see what we can do."
• and work altogether for (i) cases where the site is faulty, (ii) cases where the user, in good faith, has made a mistake and (iii) cases where the user has tried to trick the site.

For these latter, a well-designed message will not explicitely state that they've been discovered but it will imply the following "feel free to try as many times as you want, you'll always get the same result..."

Unless you think you have a reliable way to distinguish tricking attempts from real mistakes, it might be better not to craft a message that talks about missing permissions as it can be somewhat violent and confusing for good faith users. You might therefore want to remain generic.

This page http://www.creativebloq.com/web-design/best-404-pages-812505 has gathered plenty of very good examples that can inspire you.