Security constraints not working properly, SAP security note 1536158

SAP security note 1536158, “Security constraints not working properly”. Below are the symptom and SAP recommended solution.

Description

Symptom

Resource that should be accessible anonymously returns HTTP error code 403 – Forbidden.

Solution

Deploy the latest patch level of the ENGINEAPI.sca for the corresponding Support Package.

Reason and prerequisites

A programming error causes the following behavior: Two or more security constraints are defined for one URL. One is for anonymous access for some of the HTTP methods, and another defines access for other HTTP methods to be allowed for some role.

Example:

<servlet-mapping>
  <servlet-name>test</servlet-name>
  <url-pattern>/test</url-pattern>
</servlet-mapping>
<!--
  Allow GET to anybody.
-->
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected area 1</web-resource-name>
    <url-pattern>/test/*</url-pattern>
    <http-method>GET</http-method>
  </web-resource-collection>
</security-constraint>
<!--
 Allow all other methods to some-role.
 -->
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected area 2</web-resource-name>
    <url-pattern>/test/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>some-role</role-name>
  </auth-constraint>
</security-constraint>

After deploying the application, the resource is not accessible anonymously for the methods defined in the first constraint.