Clickjacking protection prevented the Fiori Launchpad to load in a frame

[former_member268669]

Hello All,

We are on SAP NetWeaver Portals 7.40 SP12 and Fiori Launchpad is the entry point. We have a dedicated NetWeaver Gateway system (7.40 SP12) and following central hub deployment architecture for UI5 and Fiori development. When we tried to integrate a standard fiori component (Gateway) into Fiori launchpad (Portal) through Fiori iView template, We are getting the following error.

"Uncaught Error: Clickjacking protection prevented the Fiori Launchpad to load in a frame"

We applied the note "2142551 - Whitelist service for Clickjacking Framing Protection in AS ABAP". We added host name of the Portals in HTTP_WHITELIST table on NetWeaver gateway system. But still getting the same error.

Could you please suggest if there is more to do to resolve the issue.

Thanks,

Sudheer.

[former_member611122]

you should edit index.html on script code like this

<script

id='sap-ui-bootstrap'

src='resources/sap-ui-core.js'

data-sap-ui-frameOptions='allow'>

</script>

and this link will be more helpful for you

https://sapui5.hana.ondemand.com/#/topic/62d9c4d8f5ad49aa914624af9551beb7

[Rakesh_Kr]

Hi Sudheer,

I am also implementing a similar scenario " FLP integration with SAP Portal" using iview template & using FFP. I would like to know few things from your experience.

1.If web-dispatcher is in place for integration scenario, do we still need to implement sap note "2142551 - Whitelist service for Clickjacking Framing Protection in AS ABAP" to avoid clickjacing issue ?
2.If yes! to above question, is updating "HTTP_WHITELIST" table with portal entry sufficient to avoid clickjacing issue, or do we also need some code modification in SAP GW* for UI component ?

Hoping for your experienced advice on my queries which would make it easier for me to implement required options.

GW* : Gateway

Thanks,

Rakesh

[former_member268669]

Hello Rakesh,

After we upgraded portal (UI5 version - to same level or higher than Gateway), We didn't implement note 2142551. Both Remote Catalogs and iView Template approach working for us after upgrade.

I hope this answers your question.

Thanks,

Sudheer.

[Rakesh_Kr]

Hi Sudheer,

Thanks for the reply, from your above answer I understand that if portal UI5 version is higher than Gateway, the clickjacking issue won't occur and hence we won't need to apply the Sap Note mentioned above and just web-dispatcher configuration for Portal is sufficient for it to work properly.

Please correct me if I am wrong.

Thanks,

Rakesh

[Former Member]

Hi,

Were you able to resolve the issue where the iview displayed content is non editable in FLP?

Regards

Radhika

[former_member268669]

Hello Radhika,

We solved the issue by upgrading portals to be on higher version of SAPUI5 than of Netweaver Gateway. It is a prerequisite.

Thanks,

Sudheer.

[Former Member]

Hi All,

We Whitelist the server and port as per the note "2142551 - Whitelist service for Clickjacking Framing Protection in AS ABAP" in Gatway server ABAP. When we open the Fiori iViews is disabled.

Our SAP ABAP SAPUI5 libraries are on 1.36.1 and we upgraded the portal to NW 7.5 SP 05 which has the SAPUI5 librarie 1.38.6.

Our Portal UI5 Libraires are greater than ABAP.But still have the issue with iViews is disabled.

please suggest if there is more to do to resolve the issue.

thanks

Santhosh

[former_member268669]

Hi Phil,

We had a call with SAP. The reason they have given is, SAPUI5 version on Java (Portal) should be greater than ABAP (Gateway). In our case we are on 1.28 on Java (Portal) and 1.40 on ABAP (Gateway). SAP suggested to upgrade Portal.

Please let me know if you need any other info.

Thanks,

Sudheer.

[nickrankin]

Hi Sudheer,

Your SAPUI5 libraries Portal/Java side should match the version on Gateway. See Note 2261419 for more information.

Best regards,

Nick

[former_member268669]

Hi Nick,

Sorry for miscommunication. It should have been said, SAPUI5 version on Java (Portal) should be equal or greater than that of ABAP (Gateway).

Thanks,

Sudheer.

[troy_cronin2]

Hi Sudheer

Firstly many thanks for using the SAP Community Forums & a very happy new year to you 🙂

In relation to the scenario you have described and subsequent issues highlighted you mentioned - NW 7.40 SP12 and Fiori Launchpad is the entry point. You tried to integrate a standard fiori component (Gateway) into Fiori launchpad (Portal) through Fiori iView template, and are getting the following error.

• "Uncaught Error: Clickjacking protection prevented the Fiori Launchpad to load in a frame"
• You applied SAP Note "2142551 - Whitelist service for Clickjacking Framing Protection in AS ABAP" and added the host name of the Portals in HTTP_WHITELIST table on NetWeaver gateway system. But still getting the same error.

An important factor here to consider is that all required configurations are setup and maintained accordingly. Any small discrepancy can cause unpredictable and unexpected behaviour in the functional operations. - SAP Note: 2017946 - SAP Fiori application integration with NetWeaver Portal.

Now regarding the issue itself and the problem at hand there have been a few reported issues and also their associated resolutions which are covered in the following note(s): - SAP Note 2031108: SAP Fiori Integration with SAP Enterprise Portal - SAP Note 2008931: Known issue note FLP on EP

I would recommend additionally following 2169722 - Whitelist based Clickjacking Framing Protection in Enterprise Portal

Kindly update me as per your findings.

I greatly appreciate your time and patience and I look forward to receiving your reply.

Kind Regards

Troy Cronin

EP Support Engineer SAP Product Support Global Support Centre Ireland

Active SCN Forum Contributor - Follow Me @ http://scn.sap.com/people/troy.cronin2

[Former Member]

Hello John, hello Sudheer,

same problem here: fiori-disabled-frame.png

Regards,

Phil

[former_member268669]

Hello John,

Thanks for your response. We have followed the blog mentioned in the note and set up web dispatcher(F5) as mentioned in the note. Now we could be able see the dynamic number on the tile and launch the iView. But the iViews is disabled. No user interaction is possible on the iView.

Could you please let us know if you have any suggestions.

Thanks,

Sudheer.

[J_D]

Hi Sudheer,

You really need to set up a web dispatcher in front of your EP and Fiori systems as per this note. There is also a workaround mentioned in that note, but SAP don't recommend it....

Regards,

John