The User Sessions were not handled correctly from End User Login Application., SAP security note 2351352

SAP security note 2351352, "The User Sessions were not handled correctly from End User Login Application." Below are the symptom, SAP recommended solution and reason and prerequisites.

Description

Symptom

If a user logs into the End User Login Application and opens any embedded application from there, then logs out from the End User Login Application, the user session was not properly invalidated. As a result, the user was able to continue performing operations on the open page of the child/embedded application.

Solution

Note to developers – we are now checking if the application is being called from the End User Login Application. If it is, then we verify whether the logged-in user session in the End User Application is active. If active, the user is allowed to perform operations; otherwise, they are not.

Please implement the attached Correction Instructions to resolve this issue.

Reason and prerequisites

Note to developers – the code did not handle checking the session before opening any application from the End User Logon.