SAP HANA Developer Guide - Get a Free Blog

9.2.3 Server-Side JavaScript Security Considerations
If you choose to use server-side JavaScript to write your application code, you need to bear in mind the potential
for (and risk of) external attacks such as cross-site scripting and forgery, and insufficient authentication.
The following list illustrates the areas where special attention is required to avoid security-related problems when
writing server-side JavaScript. Each of the problems highlighted in the list is described in detail in its own section:
● SSL/HTTPS
● Injection flaws
● Cross-site scripting (XSS)
● Broken authentication and session management
● Insecure direct object references
● Cross-site request forgery
● Incorrect security configuration
● Insecure cryptographic storage
● Missing restrictions on URL Access
● Insufficient transport layer protection
● Invalidated redirects and forwards
● XML processing issues
Inbound HTTPS/SSL Connections
● Problem
Incoming requests for data from client applications use secure HTTP (HTTPS), but the SAP HANA system is
not configured to accept the HTTPS requests.
● Solution
Ensure the SAP Web Dispatcher is configured to accept incoming HTTPS requests. For more information, see
the SAP HANA Administration Guide.
Note: The HTTPS requests are forwarded internally from the SAP Web Dispatcher to SAP HANA XS as
HTTP (clear text).
Injection Flaws
● Problem
In the context of SAP HANA XS, injection flaws mostly concern SQL injection, which can occur in the SAP
HANA XS JavaScript API or SQL script itself (both standard and dynamic).
● Solution
214
To prevent injection flaws in the JavaScript API, use prepared statements to create a query and place-holders
to fill with results of function calls to the prepared-statement object; to prevent injection flaws in standard
SQL Script, use stored procedures that run in caller mode; in caller mode, the stored procedures are
executed with the credentials of the logged-on HANA user. Avoid using dynamic SQL if possible.
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Writing Server-Side JavaScript Applications