Application Error Page (SAP Library - Security Aspects for Usage Type DI and Other Development Technol)

Application Error Page

Use

If an application error occurs, an error message of type X, A or E is created in the application and the application is terminated. Information about the short dump is forwarded to the ICF. The ICF creates a standard error page.

Example

Below is an example of an ICF standard error page:

This graphic is explained in the accompanying text

Analogous to Your Own Logoff Pages, here you can also create a separate error page for your application. You can suppress the ICF standard error page and replace it with the one you configure yourself.

Procedure

To do this, in transaction SICF go to the service node for your Web application and under Error Pages choose the tab page Application Errors and enter your data for specific error pages (see also Structure link Creating Error Pages).

Note

Especially for security reasons you should not display these error messages to external users of your application.

External Aliases

The solution for external users is to create an Structure link External Alias for the service in your application. In the external alias you can specify a separate error page and logoff page which are independent of the original service.

For example, if you have an application WDR_TEST_WINDOW_ERROR, the service is called as follows:

http://<host:port>/sap/bc/webdynpro/sap/WDR_TEST_WINDOW_ERROR

If you now create an external alias, the service could be called as follows:

http://<host:port>/WDR_TEST_WINDOW_ERROR

In this example this would make it possible for internal users who use the original service http://<host:port>/sap/bc/webdynpro/sap/WDR_TEST_WINDOW_ERROR not to have to enter any error page. The internal user would also see the error stack.

In comparison, for the external alias http://<host:port>/WDR_TEST_WINDOW_ERROR an error page could be entered. If an error occurs, depending on the browser settings the user would either see an error message or the error page from the alias that you entered. This way the external user would not have any direct information about what the error was about.

Example

...

1. Create an external alias /WDR_TEST_WINDOW_ERROR with the target /sap/bc/webdynpro/sap/WDR_TEST_WINDOW_ERROR

2. Under Error Pages ® Application Errors enter the following:

<html>

<body>

The application has to stop due to an error:<br>

<b>Error message:</b><%=MESSAGE%><br>

Please contact the system administrator for help.

</body>

</html>

3. Save your service.

Result

● You can now call the application from the external access. Choose one of the buttons here. This triggers an error message and the text entered above appears.

● Call the application with the internal URL. Also choose one of the buttons. An error stack appears.