Which of the following is a best practice for error and exception handling?

Displaying detailed error messages to end users can expose internal system architecture, stack traces, database schemas, or file paths that attackers can leverage for further exploitation. Logging the full exception details on the server side preserves the ability for administrators and developers to diagnose and fix issues while preventing that sensitive information from reaching untrusted parties.

Displaying detailed exception messages to users violates the principle of least disclosure and can reveal implementation details, server-side logic, or infrastructure information useful to an attacker.

Logging and displaying detailed error and exception messages to users combines the risks of both approaches, creating an unnecessary information disclosure vulnerability.

Not logging errors at all eliminates the ability to detect, investigate, and respond to security incidents and application failures, which violates basic operational security and incident response requirements.