7.8 Whitelist

In some situations, a framework or application on the ABAP server receives information from the outside that it potentially uses in the next steps of its interaction with the browser or with NWBC. The problem is that this externally received information could actually point to a website that is not trusted. The whitelist infrastructure allows the application to verify that the value specified is in a trusted range. It is a store where applications or frameworks can check that the received data fits to a set of configured data to be in a valid range.

It is the responsibility of the functionality provider to validate all received input before it is used. For central framework-provided functionality, the framework itself must validate these specific URL parameters to be in a valid range against the whitelist.

In the registry, for key HKEY_LOCAL_MACHINE\SOFTWARE\SAP\NWBC\Settings\WhiteList, define a subkey with the name of the connection that you have defined.

Example: If you have defined a system called MySystem, the path is HKEY_LOCAL_MACHINE\SOFTWARE\SAP\NWBC\Settings\WhiteList\MySystem.

For this subkey, define a string entry with name value. The content is the concatenation of the whitelist entries separated by blanks.

Example: value=*://*.sap.com:*/* http://*.google.com:*/* https://www.microsoft.com:*/*

An entry for the connected system is created automatically (dynamically) on the client and added to the list fetched from the server.