Application configuration due to J2EE security settings, SAP security note 1503236

SAP security note 1503236, "Application configuration due to J2EE security settings". Below are the symptom and SAP recommended solution.

Description

Symptom

You aim to enhance the security of your web applications by activating the security settings of SAP J2EE. However, enabling these settings can lead to issues with certain Web Channel applications or functions. This SAP Security Note provides the necessary configuration settings to address these problems.

Solution

To support security sessions in Web Channel applications, authentication must be carried out using the User Management Engine (UME) logon application of J2EE. Configuration depends on the application scenario (B2B or B2C).

B2B scenario applications (e.g., E-Commerce B2B, E-Service B2B, Business-on-Behalf): set the J2EE security settings SessionIdRegenerationEnabled = true, SystemCookiesDataProtection = true, and SystemCookiesHTTPSProtection = true. In Extended Configuration Management (XCM), set SSLEnabled = true (redirects to HTTPS when the login function is called) and configure UME authentication to enable session ID regeneration.

B2C scenario applications (e.g., E-Commerce B2C, E-Service B2C, Collaborative Show Room): set the J2EE security settings SessionIdRegenerationEnabled = true, SystemCookiesDataProtection = true, SecuritySessionIDHTTPSProtection = true, and SystemCookiesHTTPSProtection = false (this allows initiating requests with HTTP and switching to HTTPS during checkout). In XCM, set SSLEnabled = true and SSLSwitchEnabled = false under General Application Settings, Customer, b2c, b2cconfig.

For basket recovery, set ReInvokeEnabled = true, choose the "Javabasket" basket type in the application configuration, and activate usedatabaseBasket = true and basketRecoveryForUnknwonUser = true so the shopping basket is saved and recoverable even if the user is not logged in.

Reason and prerequisites

New security settings were introduced for the NetWeaver Application Server Java (SAP J2EE) to increase the security of web applications: SessionIdRegeneration, SystemCookiesDataProtection, SystemCookiesHTTPSProtection, and SecuritySessionIDHTTPSProtection. These enhancements help protect session data and secure cookies but require appropriate application configurations to function correctly.

References

• SAP Note 1777016 – Additional XSRF Protection switch in the XCM
• SAP Note 1548767 – Unauthorized use of functions in CRM Web Channel
• SAP Note 1501922 – The recall of the B2C application does not work
• SAP Note 1501919 – Start.jsp enhancements
• SAP Note 1492234 – No SessionIDRegeneration in CRM Web Channel B2C/B2B Scenario
• SAP Note 1310561 – SAP J2EE Engine Session Fixation Protection
• SAP Note 894446 – ECO: Using UME logon application in SAP E-Commerce