Risk
Headers, errors, traces and unprotected administrative methods can expose information useful for further attacks.
ABAPWeb DispatcherJavaHANA
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | login/show_detailed_errors | 0 Limits information disclosed during failed logon attempts. |
| ABAP Standard | service/protectedwebmethods | SDEFAULT or ALL; limited exceptions Protects sapstartsrv web methods. |
| Web Dispatcher Standard | is/HTTP/show_server_header ; is/HTTP/show_detailed_errors | FALSE ; FALSE Suppresses server headers and detailed errors. |
| Web Dispatcher Standard | icm/HTTP/admin_<num> | CLIENTHOST and ALLOWPUB=FALSE Restricts administrative clients and requires authentication. |
| Web Dispatcher Standard | icm/trace_secured_data | FALSE Prevents protected data from being written to traces. |
| Web Dispatcher Standard | icm/accept_forwarded_cert_via_http | FALSE Does not accept forwarded certificates over unsecured HTTP. |
| Web Dispatcher Standard | icm/trusted_reverse_proxy_<num> | No wildcards in SUBJECT or ISSUER Defines trusted proxies precisely. |
| ABAP Standard | rdisp/TRACE_HIDE_SEC_DATA | ON Hides sensitive data in traces. |
| Java Standard | UseServerHeader | false Disables the header in HTTP Provider Service. |
| HANA Extended | Data at rest encryption | Encrypt data, logs and backups Protect and manage encryption keys separately. |
For Web Dispatcher from NetWeaver 7.50, use icm/HTTP/auth_<xx> instead of the legacy wdisp/permission_table configuration. HTTP restrictions also apply to ICM in ABAP systems.
How to verify
- Review error messages and HTTP headers.
- Check access to ICM and sapstartsrv administration.
- Verify trusted proxy and trace configuration.
- For HANA, confirm encryption and key protection.