Automatic usage of Whitelist Service for Clickjacking Framing Protection in SAPUI5 Apps, SAP security note 2245332

SAP security note 2245332, "Automatic usage of Whitelist Service for Clickjacking Framing Protection in SAPUI5 Apps", is a program error note released on 12.07.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

You can use the whitelist service for clickjacking framing protection described in SAP Note 2319727 to define rules for protecting web applications hosted on an SAP NetWeaver ABAP system against clickjacking attacks.

If you have configured the whitelist service, you expect that any SAPUI5 app hosted on an ABAP system is automatically protected against clickjacking attacks. This, however, is not the case.

Solution

Implement this note and ensure that the following prerequisites are met:

• Whitelist Service: Implement and configure the whitelist service for clickjacking framing protection (see SAP Note 2319727).
• SAPUI5 Core Libraries: use one of the following versions of the SAPUI5 core libraries: 1.28.22 (SAP Note 2249111), 1.32.7 (SAP Note 2248688), or 1.34.x or above.

If you want to use the whitelist service for clickjacking framing protection and have also implemented method /UI5/IF_CNFG_HTTP_HNDLR~RESTRICT_IFRAME_USE of the BAdI UI5/BADI_CONFIG_HTTP_HANDLER for restricting iFrame use in general, make sure that both the whitelist service and the BAdI method are aligned. Otherwise, whitelist entries that allow operation of an SAPUI5 app in an iFrame on a specific server may not work as expected. Also, consider removing the implementation of the BAdI method.

Reason and prerequisites

You can use the clickjacking framing protection feature in addition to or as a replacement for the existing option for setting the X-Frame-Options HTTP response header of SAPUI5 apps via BADI /UI5/BADI_CONFIG_HTTP_HANDLER described in SAP Note 2075016. The clickjacking framing protection feature provides more flexibility regarding the hosts that are allowed to embed a protected app in an iFrame. Bear in mind that the protection provided by this SAP Note is automatically activated for all SAPUI5 apps on the system and that you don’t have to modify them.

CVSS

Score 0

References

Affected components

• UI_INFRA 100
• SAP_UI 740
• SAP_UI 750
• UI_700 200