SAP Note

Header Data

Symptom

In the WebClient UI you use the transaction launcher for integrating BOR objects with SAP GUI for HTML. On ending the launch transaction you get a popup with this error text: Cross-frame scripting has been denied by the browser for security reasons. Protocol or domain of the inline frame did not match with the main window. Then the protocol and domain of the inline frame are listed.

Other Terms

Reason and Prerequisites

Solution

The URL in the browser address bar has the following composition: ://.:/... Compare the protocol in the address bar of your browser with the protocol of the inline frame. If they are not the same (one is HTTP and the other is HTTPS) then continue reading at "Protocol Mismatch". Compare the domain in the address bar of your browser with the domain of the inline frame. If they are not the same then continue reading at "Domain Mismatch". Related document at Microsoft ("About Cross-Frame Scripting and Security"): http://msdn.microsoft.com/en-us/library/ms533028%28VS.85%29.aspx

Protocol Mismatch

We have to ensure that the used protocols are the same to allow cross-frame scripting. There are three different ways to get this. The first two possibilities are static adjustments. The third possibility automatically uses the matching protocol:

1. Starting the WebClient UI with the protocol that is used within the inline frame. (Note that with a change of the protocol the port has to change accordingly. You can have a look at transaction SMICM, Goto - Services for a list of protocols and assigned ports.)

2. Starting the launch transaction with the protocol that is used for the WebClient UI. You can change this setting in field "URL of ITS" in transaction CRMS_IC_CROSS_SYS. (There can be multiple entries. In the executed launch transaction you can have a look in the status line of SAP GUI for HTML and get the system ID. This helps in identifying the correct line in CRMS_IC_CROSS_SYS.)

3. For a dynamic matching of protocol and port go into transaction CRMS_IC_CROSS_SYS and set the indicator "Local ITS" of the line that is used by your launch transaction. (For getting the correct line either have a look into the settings of the launch transaction or check the system ID within the executed launch transaction and deduce the corresponding line.)

Starting WEBCUIF701 SAP recommends to use option (3).

Domain Mismatch

In general if the two domains have at least one common part then the concept of domain relaxation can be used to allow the cross-frame scripting. But as the WebClient UI only supports minimal domain relaxation, i.e. take the fully qualified domain names and truncate the host names, then the remaining domain part has to be identical.

Validity

1427124 - LTX - Cross-frame scripting has been denied by the browser

Version 5 Validity: 04.02.2011 - active Language English (Master)

Released On 04.02.2011 12:55:51 Release Status Released for Customer Component CA-WUI-APF Application Frame

CRM-FRW-AFP Please use CA-WUI-APF instead

Priority Correction with low priority Category Consulting

Software Component From Rel. To Rel. And Subsequent

Other Components

References

This document refers to:

SAP Notes

This document is referenced by:

SAP Notes (1)

WEBCUIF 701 701

1013376 FAQ Note: CRM WebClient Transaction Launcher

1013376 FAQ Note: CRM WebClient Transaction Launcher