Collective Note ABAP Session Protection Recommendations, SAP security note 1532777

SAP security note 1532777, "Collective Note: ABAP Session Protection Recommendations". Below are the symptom and SAP recommended solution.

Description

Symptom

You want to protect your ABAP system against common session attacks such as session hijacking and session fixation.

Solution

1. Implement Note 1420203 to support applications that require 3rd parties (other HTTP clients) to access stateful HTTP applications, despite the activated session protection mechanisms described in the notes listed below.
2. After applying Note 1420203, apply the appropriate application notes based on your SAP_BASIS component version:
3. Apply Note 1531399 to enable SSL. This ensures that credentials, session identifiers, and all access-controlled business data are transmitted in encrypted form, preventing eavesdropping attacks.

• SAP_BASIS 6.40: Recommended Note 1266780
• SAP_BASIS 7.00: Recommended Note 1266780
• SAP_BASIS 7.01: Recommended Note 1277022
• SAP_BASIS 7.02: Recommended Note 1322944 (Alternatively Note 1277022)
• SAP_BASIS 7.03: Recommended Note 1322944 (Alternatively Note 1277022)
• SAP_BASIS 7.10: Recommended Note 1277022 (Alternatively Note 1524152)
• SAP_BASIS 7.11: Recommended Note 1277022 (Alternatively Note 1524152)
• SAP_BASIS 7.20: Recommended Note 1322944 (Alternatively Note 1277022)
• SAP_BASIS 7.30: Recommended Note 1322944 (Alternatively Note 1277022)

Important Remarks

• The activation of the session protection mechanisms (by setting profile parameters icf/user_recheck or icf/ssocookie_mandatory, or by activating Security Session Management, if applicable) should always be the last step.
• When performing an SAP_BASIS upgrade from 6.40 or 7.00 to 7.01 (or higher), you must repeat the activation of the session protection mechanism as described in Note 1532874.
• Prior to activating Security Session Management, apply Note 1471069 if you are using a Portal (this is also mentioned in Note 1322944).

Reason and prerequisites

Previously, the ABAP server performed an access control check only when starting an application. When processing subsequent HTTP requests to stateful applications, only the application session identifier (which can be transmitted in the URL) was validated.

References

• Note 1562004: Option: Issuing assertion tickets without logon tickets
• Note 1532874: Upgrade: Changing the HTTP reauthentication
• Note 1531399: Enabling SSL for Session Protection
• Note 1524152: Correction instructions for Note 1277022
• Note 1521197: Update #1 to Security Note 1517094
• Note 1517094: CRM-IC: Session Access Token
• Note 1512081: CLOCO – GANTT is not displayed II
• Note 1510360: CRM marketing applets: Problems with icf/set_HTTPonly_flag
• Note 1506858: Security updates for Live Auction Cockpit
• Note 1505976: Webdocs: Unauthorized Content Modification & Session Handling
• Note 1457125: Java Applet not working in cFolders
• Note 1420203: Enable foreign access to a stateful HTTP session
• Note 1322944: ABAP: HTTP security session management
• Note 1277022: Security Note: Session Forwarding by URL
• Note 1266780: User check for each HTTP request