Technology Blogs by SAP
Learn how to extend and personalize SAP applications. Follow the SAP technology blog for insights into SAP BTP, ABAP, SAP Analytics Cloud, SAP HANA, and more.
cancel
Showing results for 
Search instead for 
Did you mean: 
15,697
For security reasons, browsers make sure that front end JavaScript code which is originated from a certain origin do only back-end calls to the same origin host. however with CORS, hosts can inform the browser via some headers that such calls from certain origins can be allowed. to read more about CORS please read more here. With this enablement, your SAC will be able to communicate directly with your BW inA API without the need to run an additional reverse proxy.

ABAP Netweaver 7.52+ supports CORS setup out of the box, however for older version there is a workaround which can be done. this brief article will guide you to enable direct connections for both scenarios.

 

Netweaver 7.52+


Make sure that icf/cors_enabled is set to 1.

Go to transaction UCONCOCKPIT > Uniefeid Conictivity Scenario Selection > HTTP White List Scenario > Cross-Origin Resource Sharing.

Go To Edit Mode and add the following three entries for the BW InA services:

1. GetServerInfo service


Service Path : /sap/bw/ina/getserverinfo/
Host rule: your origin host name, (more entries comma seperated, or * for all).
Allowed Methods: Get, POST,OPTIONS
Allowed Headers: AUTHORIZATION,X-CSRF-TOKEN,X-SAP-CID,ACCEPT-LANGUAGE
Exposed Headers: X-CSRF-TOKEN, SAP-REWRITEURL, SAP-URL-SESSION-ID
Allow Credentials: has to be active.
Max Age: 600



 

2. GetResponse service


Service Path : /sap/bw/ina/getresponse/
Host rule: your origin host name, (more entries comma seperated, or * for all).
Allowed Methods: Get, POST, OPTIONS
Allowed Headers: AUTHORIZATION,CONTENT-TYPE,MYSAPSSO2,X-CSRF-TOKEN,X-SAP-CID,ACCEPT-LANGUAGE
Exposed Headers: X-CSRF-TOKEN, SAP-REWRITEURL, SAP-URL-SESSION-ID
Allow Credentials: has to be active.
Max Age: 600



 

2. Logoff service


Service Path : /sap/bw/ina/logoff/
Host rule: your origin host name, (more entries comma seperated, or * for all).
Allowed Methods: GET,OPTIONS
Allowed Headers: AUTHORIZATION,X-SAP-CID,ACCEPT-LANGUAGE
Exposed Headers: X-CSRF-TOKEN, SAP-REWRITEURL, SAP-URL-SESSION-ID
Allow Credentials: has to be active.
Max Age: 600



After adding the three services, you have to save your changes.

Netweaver 7.4+


Note: This workaround relies on the following post. for more detailed information please read more there.

On your BW system, create a file somewhere (ex: /usr/sap/<SID>/SYS/profile/cors_rewrite), then add it to icm/HTTP/mod_0 as the following:
icm/HTTP/mod_0 = PREFIX=/,FILE={path_to_cors_rewrite_file}

The file should hold the following content:
if %{HEADER:isSACOriginAllowed} = true
setHeader isSACOriginAllowed false

if %{HEADER:ORIGIN} regimatch ^(http(s)?:\/\/)?{SAC_HOSTNAME} [AND]
if %{PATH} regimatch (\/sap(\(.*\))*\/bw\/ina\/*) [AND]
if %{REQUEST_METHOD} regimatch (GET|POST|OPTIONS)
setHeader isSACOriginAllowed true

if %{HEADER:isSACOriginAllowed} = true
begin
setResponseHeader Access-Control-Allow-Origin %{HEADER:ORIGIN}
setResponseHeader Access-Control-Allow-Methods GET,POST
setResponseHeader Access-Control-Allow-Headers x-csrf-token,x-sap-cid,authorization,mysapsso2,x-request-with,sap-rewriteurl,sap-url-session-id,content-type,accept-language
setResponseHeader Access-Control-Max-Age 600
setResponseHeader Access-Control-Expose-Headers x-csrf-token,sap-rewriteurl,sap-url-session-id,sap-perf-fesrec,sap-system
setResponseHeader Access-Control-Allow-Credentials true
setResponseHeader vary Origin
end

if %{HEADER:isSACOriginAllowed} = true [AND]
if %{REQUEST_METHOD} stricmp OPTIONS
begin
regRewriteUrl ^/(.*) /sap/public/ping
removeResponseHeader Set-Cookie
removeResponseHeader Expires
end

kindly replace {SAC_HOSTNAME} with your SAC host name(s) ( including port if none standard), you may also adapt the pattern to meet your requirement (http or https or both ..)

 

Finally you have to restart your ABAP system.

 

After that you should be able to create a direct Live BW connection in SAC :



 

 

Notes


Note #1: as a prerequisite, you will have to unblock third party cookies in your browser

Chrome:



Safari:



Note #2: for the same BW back-end system, you may configure either a direct connection or a path connection over a reverse proxy, if end user mixes between both scenarios in the same session for the same back-end then session handling could be impacted and unpredictable behavior is expected to happen.
9 Comments