Encryption of the ‘state’ field of JSF Pages, SAP security note 1485551

SAP security note 1485551, "Encryption of the ‘state’ field of JSF Pages", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

You are developing a JavaServer Faces (JSF) application and need to store session state information on the client-side. It is crucial to ensure that this session state information is always encrypted to protect against potential security threats.

Solution

To ensure that the client-side state is protected, you must encrypt the state by adding the com.sun.faces.ClientStateSavingPassword entry to the web.xml deployment descriptor:

• env-entry-name: com.sun.faces.ClientStateSavingPassword
• env-entry-type: java.lang.String
• env-entry-value: SOME_PASSWORD (replace with a strong password of your choice)

This configuration ensures that the state is encrypted using the specified password.

References

• SAP NetWeaver Composition Environment 7.1 Documentation
• SAP NetWeaver 7.00/7.01/7.02/7.03 Documentation
• SAP NetWeaver ’04 Documentation