We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are not working, and their support team has a pretty vague and dissatisfactory answer,they said that the application doesn't require such headers security mechanisms are already in place to mitigate a variety of attacks.

Now me and my team are helpless. Has someone achieved it? The application in question are SRM, Fiori, GRC & ROS.

1 Answer 1


Before adding any headers I'd carefully investigate whether they could break any normal functionality of the application. ERP systems like S/4 HANA are quite complex, and playing with external security features may cause something unexpected. Furthermore, it may make diagnosing any problems harder, because the support doesn't expect such headers in place, as they believe and announce this kind of problems are mitigated by other means.

Once you have acknowledged this, you do have some possibilities for adding the headers:

SAP Web Dispatcher

From SAP Web Dispatcher Modification of HTTP Requests:

If an SAP Web Dispatcher is configured, HTTP requests first go the Web Dispatcher, which then filters the requests and distributes them to the application servers connected in the SAP system. If no SAP Web Dispatcher is configured, HTTP requests go directly to the Internet Communication Manager (ICM) on an application server.

It is more practical to modify an HTTP request before it is forwarded to the application server. The rewrite handler, which is implemented as part of the HTTP plug-in in Web Dispatcher and in Internet Communication Manager, provides the functions to perform modification actions. You can perform different request modifications in the HTTP server (SAP Web Dispatcher or Internet Communication Manager):

With the syntax <headerop> <name> <pattern> <value> your configuration could contain e.g.

SetResponseHeader Content-Security-Policy script-src 'self'
SetResponseHeader X-Frame-Options SAMEORIGIN
SetResponseHeader X-Content-Type-Options nosniff

Reverse proxy

More generally, if a web application doesn't have a functionality to control headers, you can always place a reverse proxy in front of it. A lightweight solution is NGINX Reverse Proxy. E.g.

server {
    server_name sap.example.com;
    location / {
        proxy_pass  https://backend-sap.example.com;
        add_header  Content-Security-Policy  "script-src 'self'";
        add_header  X-Frame-Options          "SAMEORIGIN";
        add_header  X-Content-Type-Options   "nosniff";

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .