Browsing Web Shop via HTTP with SessionIDRegenerationEnabled, SAP security note 1449940

SAP security note 1449940, "Browsing Web Shop via HTTP with SessionIDRegenerationEnabled". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Session cookies transmitted over plain HTTP connections are vulnerable to theft and can be exploited for session hijacking. While the SystemCookiesHTTPSProtection property can secure these cookies, it prevents scenarios where anonymous browsing via HTTP is required alongside authenticated browsing via HTTPS.

Solution

• 1. Upgrade the Engine: Upgrade to the latest version as specified in the SP Patch Level section. Ensure that Note 1310561 is applied before proceeding with this upgrade.
• 2. Activate Session Identifier Cookie Protection: Open Configtool. Navigate to: cluster-data -> Global server configuration -> services -> http. Locate the SecuritySessionIDHTTPSProtection property. Set its value to true. Save the changes and restart the server nodes for the settings to take effect.

Reason and prerequisites

Properties Involved:

• SystemCookiesHTTPSProtection: When set to true, it adds the secure attribute to all session cookies, ensuring they are only sent over HTTPS. However, this disables anonymous HTTP browsing.
• SecuritySessionIDHTTPSProtection: When enabled, only part of the session cookies have the secure attribute, allowing anonymous HTTP browsing up to the point of user authentication. Post-authentication, all session tracking occurs over HTTPS.

Prerequisites:

• Enable Session ID Regeneration: Set the SessionIdRegenerationEnabled property of the servlet_jsp service to true.
• Configure HTTPS Protection: Ensure SystemCookiesHTTPSProtection is set to false if you intend to use SecuritySessionIDHTTPSProtection. If SystemCookiesHTTPSProtection is true, the SecuritySessionIDHTTPSProtection property will be ignored.

References

Affected components

• Applicable to various software components, including ENGINEAPI, SAP-JEECOR, and SERVERCORE across multiple versions.