Risk
A ticket or cookie sent over the wrong channel can be captured and reused for logon.
ABAPJava
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | login/ticket_only_by_https | 1 Account for HTTPURLLOC when generating HTTPS URLs. |
| ABAP Standard | login/ticket_only_to_host | 1 Returns the ticket only to its issuing host. |
| ABAP Standard | icf/set_HTTPonly_flag_on_cookies | Recommended 0; not 1 or 3 Enables HttpOnly protection for ICF logon cookies. |
| ABAP Standard | login/accept_sso2_ticket | 2 Accepts Assertion Tickets and rejects SAP Logon Tickets. |
| Java Extended | ume.logon.security.enforce_secure_cookie | true Sets Secure for logon cookies. |
| Java Extended | ume.logon.httponlycookie | true Protects cookies from JavaScript access. |
| Java Extended | login.ticket_lifetime | ≤ 8 hours Limits ticket lifetime. |
| Java Extended | portal.alias.security.enforce_secure_cookie | true Sets Secure for the Portal Alias Cookie. |
How to verify
- Confirm ticket types and SSO dependencies.
- Check HTTPURLLOC and generated URLs.
- Verify Secure and HttpOnly cookie flags.
- Test the complete cross-system logon flow.