4 weeks ago
Hello Team,
We have received a security vulnerability from our security team and the fix was to Configure the remote web server to use HSTS. This has to be done on our sandbox database server. Could you please let us know the steps which can be taken to implement this on the database server.
SAP HANA has two primary means by which it communicates with clients:
For the HTTP communication used for XS classic applications, SAP HANA implements an internal SAP Webdispatcher to route communication to the appropriate database for processing (see Maintain Standard HTTP Port Numbers with SAP HANA XS). Therefore, you can configure the webdispatcher to accomplish HSTS as per 3359291 - Configuring HSTS with Web Dispatcher or ICM.
The simplest means to disable non-TLS HTTP communication, is to reconfigure the webdispcher.ini > [profile] section from the SYSTEMDB by either:
For SQL communication, you can force TLS with configuration parameter sslenforce.
Best regards,
Tyler
SAP Technical Support | BTP HANA
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
User | Count |
---|---|
68 | |
10 | |
10 | |
7 | |
6 | |
6 | |
6 | |
5 | |
5 | |
4 |
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.