Clickjacking (UI Redressing) Protection
The concept name was not provided, so a precise definition cannot be written. Based on the sources, the closest identifiable concept is the Protection Allowlist (also surfaced via the whitelistService), which is a security mechanism on SAP BTP that allows developers to maintain a list of trusted hosts or domains to help prevent attacks such as clickjacking. Developers use the Maintain Protection Allowlists app or the Protection Allowlist Read Integration service to read and manage these trusted entries at the subaccount level. Enabling the allowlist service causes the SAPUI5 runtime to send a request to a configurable endpoint, which then validates whether a given host is trusted before allowing the application to be embedded.
Tutorials that teach this
Docs explaining this concept
- Doc Apps for Configuring Frontend Communication Security
- Doc Clickjacking Protection
- Doc Clickjacking Protection - Entity
- Doc Configure Trusted Domains for Multi-Environment Subaccounts
- Doc Content Security Policy - Read Integration
- Doc Environment Variables
- Doc Frontend Communication Security
- Doc Integrating Protection Allowlist Data (Read)
Prerequisites
- Concept Same-Origin Policy The Same-Origin Policy is a browser security mechanism that blocks web pages from making requests to a different origin (domain, protocol, or port) than the one that served the page. Developers encounter it when an SAPUI5 or other web application attempts to call a backend service hosted on a different domain, causing the request to fail. To resolve this, [Cross-Origin Resource Sharing (CORS)](https://ui5.sap.com/#/topic/672301f4f47640a8b2bc817d2ce0f512) must be configured, which involves [adding trusted hosts](https://help.sap.com/docs/btp/sap-business-technology-platform/5ea6325d8b2f49efae8622635dd0a542?locale=en-US&state=PRODUCTION&version=Cloud) on the server side to explicitly permit cross-origin requests.
- Concept ABAP Connectivity Basics The concept name is not defined in the provided sources, and the source snippets do not contain sufficient shared context to identify a single, clearly named concept. The sources cover a range of loosely related SAP BTP ABAP environment integration topics — such as outbound communication monitoring, the SAP Destination Service, ABAP Test Cockpit integration, and client certificate authentication — but do not converge on one definable concept. A meaningful, source-grounded definition cannot be written for an undefined concept.