Http session not found after cancelled request in FPN, SAP security note 1538139

SAP security note 1538139, “Http session not found after cancelled request in FPN”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution and references.

Description

Symptom

There are two (or more) systems in the scenario and the first system generates responses that include protected content from the other systems requiring authentication (e.g., Federated Portal). A 500 Internal Server Error is returned, and the following exception can be found in the traces:

com.sap.engine.services.servlet_jsp.server.exceptions.WebSecurityException: Security session not found. User is not logged in. Http Session is [XXXX]

Solution

• Enable "SAP Logon Tickets for Multiple Domains": This functionality ensures that when the user logs into the consumer portal, they are automatically logged into the producer portal as well. As a result, subsequent requests do not trigger authentication since the user is already authenticated. Therefore, canceling the long-running request does not impact any subsequent requests.
• Configure Multi-domain Cookie for Consumer Portal UME: Follow the guidelines provided here to configure the consumer portal UME with a multi-domain cookie.

This solution should be applied even if all portals are within the same domain, despite being originally designed for portals in different domains.

Reason and prerequisites

• The web container service property for session fixation protection SessionIdRegenerationEnabled is set to true, causing session identifier regeneration.
• The grace period defined in the SecuritySessionIdGracePeriod property of the web container is greater than 0, and Session Fixation Protection of the corresponding policy configuration is set to "Grace period".

When the first request to the backend system that performs authentication is a long-running one and may be canceled by the user, the session identifier is not sent to the client due to the cancellation. Consequently, all subsequent requests received after the grace period are considered hacker requests and are rejected with the exception mentioned in the symptom.

References

• 1310561 – SAP J2EE Engine Session Fixation Protection