ITSSM_sendSessInfo returns "Session not fail-safe"

[Former Member]

Dear all,

We upgraded to ITS 6.20 PL20 here with R/3 4.7 and in both IE 6 SP2 and Mozilla Firefox 1.5.0.7 sessions are terminated after a message "Session not fail-safe" appears in the status bar of the browser (the message actually only appears in IE, not in Firefox. Session is terminated all the same though). The usual "Invalid Session

You have tried to use a WWW session that has already been terminated." is displayed.

I've established that the message is triggered by JavaScript FM ITSSM_sendSessInfo, but can't explain why this suddenly happens. ~timeout (60) and ~usertimeout (.1) are fine and never caused a problem in earlier tests.

If someone could point me into the right direction, please.

Kind regards,

Michael Koch

[thorsten_domsalla]

Hello Michael,

maybe note 918265 is helpful.

The message "Session not fail-safe" is displayed in case the current service running in the browser can not communicate with some management code in another hidden frame.

When the ITS service was started in the Portal (EP) the Portal takes care of session management. Mostly the message "Session not fail-safe" can be ignored when running an ITS service inside the EP.

On the other side, when the service runs standalone (outside the EP) the ITS manages the session and provides its own frontend session management with a hidden frame. Now, when this message appears, something went wrong. This could be

- the hidden frame (or frameset) was destroyed by

custom code (e. g. from an IAC)

- the frame the service runs in is not allowed to communicate cross-frame with the hidden frame.

- seldom a browser error

- the session was terminated before (timeout etc.)

Did you check in SM04 if the session was really closed?

With best regards,

TJ

[Former Member]

Hi Thorsten,

First of all many thanks for your detailed reply.

I had a look at the template and noticed that the termination only occurs after IAC which use framesets. These 2-part framesets contain navigational buttons on the top which in HTML are like this:

<form method="post" action="`WGateURL(~target="_top")`">
  <input class="button" type=submit name="~OKCode=HOME" value="Home">
  <input class="button" type=submit name="~OKCode=BACK" value="Back">
</form>

Choosing HOME or BACK will take you to the non-framed main menu. It appears that whenever a BACK or HOME command is linked to the target frame _TOP then the error message is triggered.

The session certainly is still alive, because if I re-call the URL once the message has been displayed, the system takes me back to the first screen after logon (which is not the main menu), which suggests that my user hasn't timed out, but my context has gone.

Funny thing is that this works under other PL20 ITS instances we have got here. Could this be linked to a service setting maybe?

I will have the opportunity tomorrow to compare service settings with another PL20 ITS instance in which this is supposed to work - I will report back on this then.

M

[Former Member]

I think I have solved the problem.

I spotted that within the service parameters for this IAC the ~webgui parameter was set to "1", which switched on ITS SM.

Once this was changed the "Session not fail-safe

[thorsten_domsalla]

Hello Michael,

if the <form>

<form method="post" action="`WGateURL(~target="_top")`">

is submitted, the response is targeted to the top frame. It also will overwrite the session management frame. Now, since the hidden frame is gone the service can't communicate with it and writes the message.

I wonder why the session is not terminated since the frame gets unloaded ...

However, it is dangerous to use targets as parent or top in an embedded environment.

Why is the target _top? Isn't there another - secure - way?

Best regards,

TJ

[thorsten_domsalla]

Hello Michael,

I don't understand. You have an IAC with service files containing ~webgui set to 1 (activating SAP GUI for HTML)? In that case it not an IAC anymore but something in between IACs and SAP GUI for HTML ... undefined.

The ITS' frontend session management is activated per default in SAP GUI for HTML. And it is deactivated in all other services (IAC) since there is no generic DHTML environment. However, frontend session management can be activated with parameter ~disconnectonclose for IAC (see note 689291) but this on customer's risk.

With best regards,

TJ

[Former Member]

Hi Thorsten,

> I don't understand. You have an IAC with service

> files containing ~webgui set to 1 (activating SAP GUI

> for HTML)? In that case it not an IAC anymore but

> something in between IACs and SAP GUI for HTML ...

> undefined.

>

That's exactly what we have got here. It's a bunch of transactions, some with custom web templates, some without (they therefore drop right into the WebGUI, as ITS is in mixed mode here).

> The ITS' frontend session management is activated per

> default in SAP GUI for HTML. And it is deactivated in

> all other services (IAC) since there is no generic

> DHTML environment. However, frontend session

> management can be activated with parameter

> ~disconnectonclose for IAC (see note 689291) but this

> on customer's risk.

Isn't this what also the ~webgui does? Since I switched it off the JavaScript includes are not copied in anymore on my templates and the HTML title is actually what I named it in my HTML code.

Anyroad... it seems to be sorted now.

Many thanks again,

Michael Koch

[Former Member]

In th meantime, I found the following SAPNet note on this:

918265 - SAP GUI for HTML in EP: /!\ Session not fail-safe /!\

<i>If you use the SAP GUI for HTML of the NetWeaver ITS plug-in in the SAP Enterprise Portal, the message "/!\ Session not fail-safe /!\" sometimes appears in the status line of the browser.

While this message refers to an internal problem, it is not critical in the case of the SAP GUI for HTML in the portal.</i>

We are not using SAP EP here, but running bespoke web templates for IACs. In our case sessions are terminated after the status message appears.