SAP HANA Developer Guide - Get a Free Blog

Cross-site request forgery
● Problem
Since there are no clear trust boundaries between different Web sites running in the same Web-browser
session, an attacker can trick users (by sending an e-mail or luring them to a popular Web site that is under
the attacker's control) into clicking a specific hyperlink. The hyperlink displays a Web site that performs
actions on the visitor's behalf, for example, in a hidden iframe.
● Solution
Include a random token in the POST submission which is validated on the server-side. Only if this token is
non-predictable for attackers can one prevent cross-site, request-forgery attacks. The easiest way to prevent
cross-site, request-forgery attacks is by using the standard SAP HANA XS cookie. This cookie is randomly
and securely generated and provides a good random token which is unpredictable by an attacker
($.session.getSecurityToken()).
Incorrect security configuration
● Problem
No or an inadequate authentication mechanism has been implemented.
● Solution
Applications should have proper authentication in place, for example, by using SAP HANA built-in
authentication mechanisms and, in addition, the SAP HANA XS cookie and session handling features.
Application developers must also consider and control which paths are exposed by HTTP to the outside world
and which of these paths require authentication.
Insecure cryptographic storage
● Problem
Sensitive information such as logon credentials is exposed.
● Solution
To prevent unauthorized access, for example, in the event of a system break-in, data such as user logon
credentials must be stored in an encrypted state. Application developers can use the SAP HANA XS API,
which provides a secured key value store.
Missing restrictions on URL Access
● Problem
Unauthenticated users have access to URLs that expose confidential (unauthorized) data.
● Solution
216
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Writing Server-Side JavaScript Applications