SAP Knowledge Base Article - Public

2088904 - How to configure the Clickjacking Filter for SAP SuccessFactors HCM Suite

Symptom

This article explains how to enable and configure the Clickjacking Filter in SAP SuccessFactors.

 

Environment

SAP SuccessFactors HCM Suite

Resolution

    What is Clickjacking?
     
    Clickjacking is a web security vulnerability where an attacker tricks a user into clicking elements on a hidden or disguised webpage embedded in an iframe.
     
    How the Clickjacking Filter works?
     
    The Clickjacking Filter is an opt-in feature that controls which pages are allowed to render your SAP SuccessFactors pages or features within an iframe.
    When enabled, the system includes the header X-FRAME-OPTIONS in the HTTP responses.
     
    The filter supports the following embedding scenarios:
    • Same Original Domain Only
      • Only allow framing from the domain of SAP SuccessFactors when you don't embed SAP SuccessFactors pages or features in other web applications.
    • Define Trusted Domain
      • Add the domains of the applications you want to embed SAP SuccessFactors pages or features in as trusted domains.
      • Framing from the trusted domains is allowed after the customer successfully integrates the token generated for the URL of the application where you will embed your SuccessFactors instance.
     
    How to enable the Clickjacking Filter?
     
    The Clickjacking Filter must be enabled through Provisioning.
    • If you are working with a certified SAP Partner, contact your partner to request the activation of the Clickjacking Filter for your instance.
    • If you do not have a certified partner, create a support case under component LOD-SF-PLT-PSI and provide the necessary details for your request.

    Importante Notes when enabling: 

    • Ensure that you specify the desired configuration option (Same Origin Domain or Define Trusted Domain) when submitting your request.
    • For Define Trusted Domain, provide the URLs for the applications (including http or https) that must be added to the trusted domains.

    See Also

    Clickjacking Filter | SAP Help Portal

    Keywords

    Clickjacking, security, attack, SuccessFactors, BizX, Same Original Domain Only, Define Trusted Domain, sf bizx system/platform,sf security, clickjack, iframe, domain, lod-sf-plt-psi , KBA , LOD-SF-PLT-PSI , Product Security Inquiries , How To

    Product

    SAP SuccessFactors HCM Suite all versions