Useful Resources and Best Practices

Useful Resources

For Data Hub basic authentication, OAuth support for authorization between Data Hub and Data Hub Adapter and logging possibilities, see the Application Security section of the Data Hub documentation.

For authentication between SAP Commerce Cloud and Core+ based REST clients, see Setting Basic Authentication in Core Plus Services.

Best Practices

Follow these best practices to secure user accounts and passwords.

• Implement a CAPTCHA or RECAPTCHA to block automated attacks. Users tend to use the same email address and password combination for multiple locations. Attackers try these combinations using automated password-guessing tools on different websites and CAPTCHAS protect against these automated attempts. For more information on how to implement CAPTCHA in SAP Commerce Cloud, see captchaaddon AddOn.

• Make sure that the password reset function does not reveal whether an account exists as it could expose usernames or emails. Use "Invalid username and/or password" as a failure response rather than indicating which part of the authentication data is incorrect.

• Use a second factor authentication method. This is one of the most effective measures to block brute force or harvesting attacks. The implementation of two-factor authentication could impact your business process. For administrative accounts available from web components, always use Multi-Factor Authentication.

• Lock the account after a specified number of failed login attempts. For example, lock the account for 30 minutes after three failed attempts. While a locked-out user cannot log in until the account resets, account lockout protects against automated attacks.

• Use the password change auditing and password security policies to set a password history policy, which prevents users from reusing a set number of recently used passwords. A password history policy minimizes the risk if an old password is compromised.

• Implement a password minimum age policy along with the password history policy. A password minimum age policy prevents users from bypassing the password history policy by changing a password multiple times to continue using a preferred password. Set the password minimum age to 24 hours. See the password security policies for more details.

• Set the password maximum age to 3–6 months. When passwords reach the maximum age, users must create a new password.

• Use only POST requests for log-in forms. A POST request sends user-supplied credentials in the body of the HTTP message. Conversely, a GET request, sends credentials in a URL, which introduces an attack vector.

• Introduce context-based access control, for example only through the corporate network or a properly configured VPN to prevent and detect denial-of-service attacks.

• Implement secure failure of authentication controls.

• Implement redirections from and to the central authentication control, which must be separated from the requested resource.

• Store only salted hashes. Salted password hashing makes finding user passwords from hashed data more difficult. For more information, refer to Implementing Encoding Algorithms with the Generic Password Encoder.

• Do not use autocomplete for passwords. For more information, see Password Autocomplete.

• Use HTTPS to implement secure protocols for processing logins and to transfer any personal or sensitive data. Attackers can acquire usernames and passwords from unencrypted data in transit.

For more information, see the related links. If you need further assistance, reach out to your SAP contact.