Enable foreign access to a stateful HTTP session, SAP security note 1420203

SAP security note 1420203, “Enable foreign access to a stateful HTTP session”, is a program error note released on 02.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Foreign access attempts to a stateful HTTP session result in a "400 Session not found" error.

Solution

1. Implement Method ENABLE_FOREIGN_SESSION_ACCESS:

• Create an HTTP URL with a session access token.
• Transfer this URL to a foreign HTTP caller to execute requests in the user’s context.

2. Prerequisites for Token Creation:

• Convert the HTTP session to a stateful session using SET_SESSION_STATEFUL_VIA_URL.
• Specify a mandatory URL path in transaction SICF as an end node service.
• Optionally, specify a user ID to enforce specific logon data.
• Optionally, restrict session access tokens to single use with the one_time_access_token parameter.

3. Session Access Process:

• Tokens are created and returned in HTTP response headers.
• Foreign callers use the session access URL and token to access the stateful session.

Reason and prerequisites

Access is rejected if conditions outlined in Note 1301591 are met. To enable foreign access in specific scenarios, enhancements to the ICF and the interface IF_HTTP_SERVER are necessary.

References

• 1666244 – cFolders: Composite SAP Note – Security
• 1658516 – Applets fail due to XSRF protection (COOKIE_NOT_FOUND)
• 1442046 – HTTP 400 – Session not found (for public & stateful Service)
• 1301591 – HTTP 400 – Session not found (Stateful HTTP communication)

Affected components

• SAP BASIS and KERNEL, including versions 6.40, 7.00, 7.01, 7.02, etc.