Question Re: HTTP Security Header Not Detected in Technology Q&A

HTTP Security Header Not Detected

Former Member — Tue, 25 Aug 2020 16:27:23 GMT

Hi,

"HTTP Security Header Not Detected" is one of many security vulnerabilities from third party network scan. As per the solution provided, I need to set proper X frame option, X-Xss-protection, X-content-type-option and strict-transport-security. Our env consists of Fiori and ECC system. Any idea where to set these settings to fix this vulnerability?

Thanks

Re: HTTP Security Header Not Detected

cris_hansen — Tue, 25 Aug 2020 16:45:19 GMT

Hello,

Check SAP Note 2202116 - Support of HTTP Strict Transport Security.

If you share the SAP_BASIS version and SP level, then I can see about the other headers.

Regards,

Cris

Re: HTTP Security Header Not Detected

former_member706793 — Tue, 25 Aug 2020 17:11:39 GMT

Thanks. I will check the note.

SAP_BASIS is on 740 Sp16

Re: HTTP Security Header Not Detected

cris_hansen — Wed, 26 Aug 2020 22:34:27 GMT

Hello,

SAP Note 2860209 enables the X-Xss-protection header for WEBGUI (Handler CL_HTTP_EXT_ITS_2, used in new releases).

Regards,

Cris