Allowlist for Connection Settings¶
A mobile development kit client allows onboarding via URL or QR code scan. A URL and QR code from a third party may bring the mobile development kit app to a malicious onboarding site. To avoid the phishing attack, mobile development kit client only accepts the trusted BTP domains from an allowlist for ServerUrl, AuthorizationEndpointUrl, RedirectUrl and TokenUrl.
The allowlist defines sub-domains that BTP domains must end with. Currently allowed sub-domains include: .hana.ondemand.com, .hanatrial.ondemand.com, .scp.sapns2.us, .platform.sapcloud.cn, and .cloud.sap. To permit additional custom sub-domains, specify the AllowedDomains property in BrandedSettings.json, for example:
{
"ConnectionSettings": {
"ServerUrl": "https://mobile-<tenant>.eu2.hana.ondemand.com",
"AuthorizationEndpointUrl": "https://oauthasservices-<tenant>.eu2.hana.ondemand.com/oauth2/api/v1/authorize",
"RedirectUrl": "https://oauthasservices-<tenant>.eu2.hana.ondemand.com",
"TokenUrl": "https://oauthasservices-<tenant>.eu2.hana.ondemand.com/oauth2/api/v1/token",
...
},
"AllowedDomains": [ ".<subdomain>.<custom-domain>.com" ],
...
}
Note
A valid sub-domain requires at least two words separated by a dot.
To support AllowCerts, sapmobilesvcs://oauth2redirect and mdkclient://oauth2redirect can be used as the value for RedirectUrl.