Skip to Content

SAP HANA Extended Application Services

With SAP HANA SP5*, we introduce an exciting new capability called SAP HANA Extended Application Services (sometimes referred to unofficially as XS or XS Engine). The core concept of SAP HANA Extended Application Services is to embed a full featured application server, web server, and development environment within the SAP HANA appliance itself. However this isn’t just another piece of software installed on the same hardware as SAP HANA; instead SAP has decided to truly integrate this new application services functionality directly into the deepest parts of the SAP HANA database itself, giving it an opportunity for performance and access to SAP HANA differentiating features that no other application server has.

Before SAP HANA SP5 if you wanted to build a lightweight web page or REST Service which consumes SAP HANA data or logic, you would need another application server in your system landscape. For example, you might use SAP NetWeaver ABAP or SAP NetWeaver Java to connect to your SAP HANA system via a network connection and use ADBC (ABAP Database Connectivity) or JDBC (Java Database Connectivity) to pass SQL Statements to SAP HANA.  Because of SAP HANA’s openness, you might also use Dot Net or any number of other environments or languages which support ODBC (Open Database Connectivity) as well. These scenarios are all still perfectly valid.  In particular when you are extending an existing application with new SAP HANA functionality, these approaches are very appealing because you easily and with little disruption integrate this SAP HANA functionality into your current architecture.

However when you are building a new application from scratch which is SAP HANA specific, it makes sense to consider the option of the SAP HANA Extended Application Services.  With SAP HANA Extended Application Services you can build and deploy your application completely self-contained within SAP HANA; providing an opportunity for a lower cost of development and ownership as well as performance advantages because of the closeness of the application and control flow logic to the database. 

Applications designed specifically to leverage the power of SAP HANA, often are built in such a way to push as much of the logic down into the database as possible.  It makes sense to place all of your data intensive logic into SQL, SQLScript Procedures, and SAP HANA Views, as these techniques will leverage SAP HANA’s in-memory, columnar table optimizations as well as massively parallel processing. For the end-user experience, we are increasingly targeting HTML5 and mobile based applications where the complete UI logic is executed on the client side. Therefore we need an application server in the middle that is significantly smaller than the traditional application server. This application server only needs to provide some basic validation logic and service enablement. With the reduced scope of the application server, it further lends credit to the approach of a lightweight embedded approach like that of the SAP HANA Extended Application Services.


Figure 1 – Architectural Paradigm Shift

SAP HANA Studio Becomes a Development Workbench

In order to support developers in creating applications and services directly within this new SAP HANA Extended Application Services, SAP has enhanced the SAP HANA Studio to include all the necessary tools. SAP HANA Studio was already based upon Eclipse; therefore we were able to extend the Studio via an Eclipse Team Provider plug-in which sees the SAP HANA Repository as a remote source code repository similar to Git or Perforce. This way all the development resources (everything from HANA Views,  SQLScript Procedures, Roles, Server Side Logic, HTML and JavaScript content, etc.) can have their entire lifecycle managed with the SAP HANA Database.  These lifecycle management capabilities include versioning, language translation export/import, and software delivery/transport.

The SAP HANA Studio is extended with a new perspective called SAP HANA Development. As Figure 2 shows, this new perspective combines existing tools (like the Navigator view from the Modeler perspective) with standard Eclipse tools (such as the Project Explorer) and new tools specifically created for SAP HANA Extended Application Services development (for example, the Server Side JavaScript editor shown in the figure or the SAP HANA Repository browser). Because SAP HANA Studio is based on Eclipse, we can also integrate other Eclipse based tools into it. For example the SAP UI Development Toolkit for HTML5 (SAPUI5) is also delivered standard in SAP HANA Extended Application Services.  HANA 1.0 SP5 comes pre-loaded with the 1.8 version of the SAPUI5 runtime and the SAPUI5 development tools are integrated into SAP HANA Studio and managed by the SAP HANA Repository like all other XS based artifacts. Although the SAPUI5 development tools are integrated into SAP HANA Studio, they are not installed automatically.  For installation instructions, please see section 10.1 of the SAP HANA Developers Guide.


Figure 2 – SAP HANA Development perspective of the SAP HANA Studio

These extensions to the SAP HANA Studio include developer productivity enhancing features such as project wizards (Figure 3), resource wizards, code completion and syntax highlighting for SAP HANA Extended Application Services server side APIs, integrated debuggers, and so much more.


Figure 3- Project Wizards for XS Based Development

These features also include team management functionality.  All development work is done based upon standard Eclipse projects.  The project files are then stored within the SAP HANA Repository along with all the other resources. From the SAP HANA Repository browser view, team members can check out projects which have already been created and import them directly into their local Eclipse workspace (Figure 4).

After projects have been imported into the local Eclipse workspace, developers can work offline on them. You can also allow multiple developers to work on the same resources at the same time. Upon commit back to the SAP HANA Repository, any conflicts will be detected and a merge tool will support the developer with the task of integrating conflicts back into the Repository.

The SAP HANA Repository also supports the concept of active/inactive workspace objects.  This way a developer can safely commit their work back to the server and store it there without immediately overwriting the current runtime version.  It isn’t until the developer chooses to activate the Repository object, that the new runtime version is created.


Figure 4 – Repository Import Project Wizard

For a deeper look at the basic project creation and Repository object management within SAP HANA Studio, please view the following videos on the topic.

OData Services

There are two main parts of the SAP HANA Extended Application Services programming model. The first is the ability to generate OData REST services from any existing SAP HANA Table or View.  The process is quite simple and easy.  From within an SAP HANA Project, create a file with the extension xsodata. Within this service definition document, the developer needs only to supply the name of the source table/view, an entity name, and, if using an SAP HANA View, the entity key fields.

For example, if you want to generate an OData service for an SAP HANA table named teched.epm.db/businessPartner in the Schema TECHEDEPM, this would be the XSODATA definition file you would create:

service namespace "sap.hana.democontent.epm" {
       "TECHEDEPM"."teched.epm.db/businessPartner" as "BUYER";


Figure 5 – XSODATA Service Definition and Test

Upon activation of this XSODATA file, we already have an executable service which is ready to test. The generated service supports standard OData parameters like $metadata for introspection (see Figure 6), $filter, $orderby, etc. It also supports body formats of ATOM/XML and JSON (Figure 7 for an example). Because OData is an open standard, you can read more about the URL parameters and other features at


Figure 6 – OData $metadata support


Figure 7 – Example OData Server JSON Output

The examples in the above figures demonstrate how easily these services can be tested from the web browser, but of course doesn’t represent how end users would interact with the services. Although you can use a variety of 3rd party tools based upon JavaScript, like Sencha, Sencha Touch, JQuery, JQuery Mobile, and PhoneGap, just to name a few; SAP delivers the UI Development Toolkit for HTML5 (SAPUI5) standard in SAP HANA Extended Application Services. A particularly strong feature of SAPUI5 is the integration of OData service consumption not just at a library level but also with special features within the UI elements for binding to OData services.

For example, within SAPUI5, you can declare an OData model object and connect this model object to the URL of the XSODATA service. Next, create a Table UI element and connect it to this model object. Finally you call bindRows of the Table UI element object and supply the OData entity name you want to use as the source of the table.

var oModel = new sap.ui.model.odata.ODataModel
 ("../../services/buyer.xsodata/", false);
oTable = new sap.ui.table.Table("test",{tableId: "tableID",
 visibleRowCount: 10});      

This creates an UI Element which has built-in events, such as sort, filter, and paging, which automatically call the corresponding OData Service to fulfill the event. No additional client side or server side programming is necessary to handle such events.


Figure 8 – OData Bound Table UI Element

For more details on OData service creation in SAP HANA Extended Application Services and utilizing these services within SAPUI5, please view these videos.

Server Side JavaScript

The XSODATA services are great because they provide a large amount of functionality with minimal amounts of development effort.  However there are a few limitations which come with such a framework approach.  For example in SAP HANA SP5, the OData service framework is read only.  Support for Insert, Update, and Delete operations is available with SAP HANA SP6.

Luckily there is an option for creating free-form services where you can not only perform update operations but also have full control over the body format and URL parameter definition. SAP HANA Extended Application Services also allows development on the server side using JavaScript (via project files with the extension XSJS).  Core APIs of SAP HANA Extended Application Services are, therefore, exposed as JavaScript functions; providing easy access to the HTTP Request and Response object as well database access to execute SQL or call SQLScript Procedures.

In this simple example, we can take two numbers as URL Request Parameters and multiply them together and then return the results as text in the Response Body.  This is an intentionally basic example so that you can focus on the API usage.


Figure 9 – Simple XSJS Service

However the power of XSJS services comes from the ability to access the database objects, but also have full control over the body output and to further manipulate the result set after selection. In this example, we use XSJS to create a text-tab delimited output in order to support a download to Excel from a user interface.

function downloadExcel(){
    var body = '';
    var query = 'SELECT TOP 25000 \"PurchaseOrderId\", \"PartnerId\", to_nvarchar(\"CompanyName\"), \"LoginName_1\", \"CreatedAt\", \"GrossAmount\" FROM \"_SYS_BIC\".\"teched.epm.db/PO_HEADER_EXTENDED\" order by \"PurchaseOrderId\"';    $.trace.debug(query);
    var conn = $.db.getConnection();
    var pstmt = conn.prepareStatement(query);
    var rs = pstmt.executeQuery();
    body =
"Purchase Order Id \tPartner Id \tCompany Name \tEmployee Responsible \tCreated At \tGross Amount \n";
   while( {
        body += rs.getString(1)+
    }    $.response.setBody(body);   
    $.response.contentType = 'application/; charset=utf-16le';
    $.response.headers.set('Content-Disposition','attachment; filename=Excel.xls');
    $.response.status = $.net.http.OK;


This blog hopefully has served to give you a small introduction to many of the new concepts and possibilities with SAP HANA SP5 and SAP HANA Extended Application Services.

Over the coming weeks, we will be posting additional blogs with more advanced examples and techniques as well how to integrate SAP HANA Extended Application Services content into additional environments. Likewise there is a substantial Developer’s Guide which expands on many of the concepts introduced here.

*It is also important to note that while SAP HANA Extended Application Services ships as productive software (meaning customers can go live in production with it) in SAP HANA SP5; it is a controlled release initially, with a special “Project Solution” program in place around this new functionality.  Please refer to Service Note 1779803, for additional details on the current status of the Project Solution. This Project Solution approach is designed to provide the highest levels of support possible to initial customers and partners who choose to develop using SAP HANA Extended Application Services. It also provides a channel for feedback to Product Management and development so that we take suggestions and ideas and quickly integrate them into future revisions of SAP HANA and SAP HANA Extended Application Services.

You must be Logged on to comment or reply to a post.
  • Hi Thomas,

    Thx for valuable and useful information.

    I have an query regarding XS Odata service creation for more than 2 tables and get all the data in one command.


    There is req. in which service needs to be created for 3 tables to get data from all these.
    First table has Project ID as key, second table has composite
    ProjectID and Employee Id as key and third table has Employee id as

    So if I create navigation for first 2 tables based on project id and use expand comand than its working fine and I can see data of both the tables. 

    Further, if I add navigation for third table also as below, then below expand is displaying data for first two tables only. Pls share how to use expand command in this case if possible to get all tables data based on project id. How to use navigation ZEMPD here.

    service namespace
    "DTHCP.XS" {


       as "ZPROHEADER"

       navigates ("PROJECT" as


      as "ZACTU"

       navigates ("EMPLOYEE" as
    "ZEMPD" );


       as "ZEMPD";  

    association "PROJECT" principal

       multiplicity "1" dependent
    "ZACTU"("PROJECTID") multiplicity

      association "EMPLOYEE" principal

       multiplicity "1" dependent
    "ZEMPD"("EMPLOYEEID") multiplicity


    Pls suggest if there is anything to add or correct in XS odata service syntax above.


    Kamal Jain.

  • Hi Thomas,

    We are looking at consuming HANA data in a .NET application and from what I can see, there are 2 options - OData and ODBC. It seems to me that OData might be the better option when consuming HANA data in an XS application, while ODBC might be the better option for .NET. What are your thoughts? Is there a paper on this subject? I haven't been able to find a comparison document for this. Are there any security caveats to be aware of for these options?



    • We do plan to release an ADO.NET provider specific to HANA in the near future. This would probably be the best option for consumption from .NET. Until then I would think that ODBC is probably the next best option.  It gives you generally easy portability from already existing database code. You could consume OData as well, although that is more generally consumed from the UI layer itself. It guess it somewhat depends upon where you are calling the service from in your .NET application.

        • Thanks for the info Henrique, but I can't find it. I don't know if it is an authorization issue or do we need to be a ramp-up customer to d/l and use a beta product?



          • Hmm not really sure of that, I see it but that might be because I'm an employee.

            But the .NET development partner I was working with was not enrolled in any kind of beta testing program and they were able to download it, so I guess you should as well.

            Make sure to go in the "Installation and Upgrades" menu and not the "Support Packages and Patches".

            Go to -> Installations and Upgrades -> Browse our Download Catalog -> SAP In-Memory (SAP HANA) -> SAP HANA ADO.NET 1.0.

            Best regards,


    • For general OData structure and syntax I find that the website is very helpful.  For example on this topic:

      The syntax of a $expand query option is a comma-separated list of Navigation Properties. Additionally each Navigation Property can be followed by a forward slash and another Navigation Property to enable identifying a multi-level relationship.

      The page also has some sample URLs.

  • Hi Thomas,

    I want to call procedures in calculation view, (procedures have out parameter.)

    Please suggest me step by step procedure with example and supporting documents.



    • Your question seems to have no relation to the content in this blog. Please consider instead asking general HANA questions in the appropriate SCN Forum.

      • Hello Thomas..

        I am new to hana. Please suggest me the blogs of you. related to calculation view that calling procedures(procedures have out parameter).

        I am trying to fetch the result of procedure in calc view and want to create odata service for that calculation view.

        procedure code goes like this:



        language SQLSCRIPT sql security invoker default schema "SOCIAL360" reads sql data as




        calc view code goes like this:


        /********* Begin Procedure Script ************/



            CALL "SOCIAL360".TWEETS_TODAY(:OP,var_out);

        END /********* End Procedure Script ************/



        • I've never written any blogs on calculation views.  I don't cover that topic. That is why I suggested you ask your question in the proper SCN forum.

          Although looking at your your above SQL Statement, I don't see why you couldn't do this directly in XSODATA off of the table STATUS without the need for the calculation view or the SQLScript Procedure.

  • Hi Thomas,

    Great blog!

    I've a query here - we create the odata services(and/or URLs created to view in the web browser) in development environment, now if we have to transport it to the quality and/or production environment, how can we do this - is the same as import/export? or is there any specific way to do. please help with any useful pointers..

    Many thanks as always!


  • Hi Tom,

    Great post and videos! I have a tough issue: calling a HANA procedure from XS takes > 5min, but from HANA studio < 1 min. We're using Amazon AWS rev 70 and 73. Any help will be greatly appreciated.



  • Dear Thomas,

    Thanks for the great blog!!

    I am able to connect to Database and execute queries from XSJS service. However is it possible to consume XSODATA service from XSJS instead of using DB Connection?

    Also is it possible to consume data from external OData services for weather data, social media data etc from XSJS?

    If possible it would be great if you could provide some code sample or guidelines.




    • >However is it possible to consume XSODATA service from XSJS instead of using DB Connection?

      You can via an outbound HTTP destination; although I certainly wouldn't recommend it. It would be rather complex and not well performing.

      >Also is it possible to consume data from external OData services for weather data, social media data etc from XSJS?

      Sure, with the same Outbound HTTP Connectivity.

      Maintaining HTTP Destinations - SAP HANA Developer Guide - SAP Library

      • Thanks Thomas. I am currently checking this option only 🙂 ...

        My current requirement is to fetch Weather Data and Social Media data from various OData services and store them in HANA for further analysis. What might be the best way for this? I am currently checking the option of creating an XS application which would connect to the external services, fetch the data and save that in HANA using DB Connection. Is this the best way? Or should we try to use JAVA or some other way?

        Your valuable suggestions are most welcome. Thanks.



        • Dear Thomas,

          another question is that does the proxy settings in the HttpDestination refer to the OS user of the HANA server? We specify 'useProxy' as 'true' and  'authType' as 'basic' in the HttpDestination, but not maintain any user credentials. So when the program runs in server, would it automatically consider the OS user credentials?




          • >So when the program runs in server, would it automatically consider the OS user credentials?

            No. It doesn't automatically use anything. You have to specific the user and password that you want to use for the proxy.  Although many proxy servers don't require a username and password.

          • Thanks Thomas.

            I am facing as issue while trying to use an HTTP Destination. I understand that the .xshttpdest and .xsjs file need to in the same folder. Following is the structure of my test project.


            As you can see the HTTP Destination and the XSJS files are in the same folder 'services'. The workspace name is 'XS_Workspace' and the package structure is as follows:


            Now I am trying to read this destination.


            When I am using full package structure destination_package = "", I am receiving the error message http.readDestination: destination not found (package:, name: XSHttpDest01).

            On using the workspace name destination_package = "", I am receiving the error message User is not authorized to use destination (package:, name: XSHttpDest01).

            On using destination_package = "" also, I am receiving the error message User is not authorized to use destination (package:, name: XSHttpDest01). Strangely the 'services' folder is not directly under 'XSTest01'.

            Lastly I deliberately gave a wrong service name. destination_package = "" and destination_name = "XSHttpDest02". But even then I received the error message User is not authorized to use destination (package:, name: XSHttpDest02), not that the destination is not found!!

            Could you please help me to resolve this issue.

            Thanks a lot for your helps.



          • First of all, you would never use the workspace name. It isn't ever part of anything. It is only the package structure that counts. The first item in your list is the only one with the correct package. Off hand it looks right to me. You are supposed to supply the full package path.  Have you configured this HTTP Destination in the XS Admin tool yet?

          • Hi Thomas,

            I also tried to use the sample code from section '8.4.1 Tutorial: Use the XSJS Outbound API' of the HANA Developer Guide with minor modifications (for package structure, proxy settings etc.). This time the destination was found. The new project structure with the sample files yahoo.xshttpdest and sapStock.xsjs is as below.


            However it did not bring any data. The content of the response object indicated that there was Proxy authentication issue.

            Proxy Authentication error.jpg

            When I tried to check the Destination in the XS Admin Console, surprisingly none of the fields are populated and everything (except the 'Trust Store' drop down) is disabled. All these fields are supposed to be populated as indicated in the Modeling Guide.


            However the User already has the following privileges.

            User roles.jpg

            The same scenario was present for the Http Destination I prepared earlier. There are couple of internal errors at the bottom. On clicking them the following list is displayed.

            1. Internal Error: dbError(Connection.prepareStatement): 258 - insufficient privilege: Not authorized at ptime/query/checker/
            2. No valid SAP Crypto configuration.


            It appears from various blogs that the second error (No valid SAP Crypto configuration) is related to SSL configuration in HANA. I would contact the HANA Administrator to look into this issue. Of course it would be great if you could provide some insight.

            However I have no clue regarding the first error. Request your help and cooperation in this regard.

            The initial issue of not finding the HttpDestination which I created still persists.

            Thanks for all your help.



          • Update:

            I tried to access the XS Admin console from another user and faced only the 'No valid Crypto' error. However could still update the proxy user details and the sample application successfully ran at last. The relevant roles were provided in 'Granted Roles' not 'Application Privileges'. Probably that was the issue earlier.

            I would check again with new Http Destination and Server side Java Script.

            Thanks a lot Thomas for all your help. 🙂



          • Hi Thomas,

            Finally got my application running.. It is now fetching weather data from external sites.. 🙂 ..

            Have two more questions:

            1. Is it possible to read files using XS? For example some configuration file kept in the server?
            2. Is it possible to call a html file from the xsjs file? Something like request.getRequestDispatcher().forward() from JAVA servlets?




          • >Is it possible to read files using XS? For example some configuration file kept in the server?

            No there is no API to read from the file system of the underlying operating system. You can read the HANA configuration ini files however because they are exposed via SQL.

            >Is it possible to call a html file from the xsjs file? Something likerequest.getRequestDispatcher().forward() from JAVA servlets?

            In the body of the response you send back to the client your could issue a redirect.

          • Thanks Thomas. Could you give an example of how to redirect.

            I'm facing a strange issue while trying to import weather data from several cities together. The issue appears to be connected with the content of the response object.

            Following is the code of the Weather.xsjs file:



              var cmd = $.request.parameters.get("cmd");

              var body;

              var response;

              var obj;

              var propertyName;

              if(cmd === "import")


              var dest = $.net.http.readDestination("", "weather");

              var client = new $.net.http.Client();

              var req = new $.web.WebRequest($.net.http.GET, "/group?id=1275004,1264527,1277333,1273294,1275339&units=metric"); 

              client.request(req, dest);

              response = client.getResponse();


              $.response.contentType = "text/plain";



              body = response.body.asString();

              obj = JSON.parse(body);



              body = cmd + "\n \n" + response.status + "\n \n" + response.contentType

              + "\n \n" + response.body + "\n \n" + obj.getOwnPropertyNames();



              $.response.status = $.net.http.OK;




              $.response.contentType = "text/plain";


              $.response.status = $.net.http.INTERNAL_SERVER_ERROR;


            Following is the weather.xshttpdest:

            host = "";

            port = 80;

            description = "my weather checker";

            useSSL = false;

            pathPrefix = "/data/2.5";

            authType = none;

            useProxy = true;

            proxyHost = "<proxy_details>";

            proxyPort = "<proxy_port";

            timeout = 0;

            On accessing http://<hostname>:8000/root/work/Tara02/XSTest01/XSHttpTest01/Weather.xsjs?&cmd=import, I am receiving the error message: Body.asString : unsupported charset specified in Content-Type header ("utf8") .

            If the body = response.body.asString(); statement is commented out, I receive the error message JSON.parse: unexpected character because the response.body.asString() itself could not work correctly.

            However the URL,1264527,1277333,1273294,1275339 returns data correctly.

            Weather Data.jpg

            I am using the same URL in my code.

            Could you please advise regarding this issue. Thanks for your help.



            Weather Data.jpg
  • If someone is having difficulties with the alert "log full" on the xsengine:

    you can do the same trick as for the statisticserver in oder to reset the log area, see details in OSS Notes 2019148 and 1950221.

    The commands are then:

    select VOLUME_ID from m_volumes where service_name = 'xsengine';

    ALTER SYSTEM ALTER CONFIGURATION ('daemon.ini', 'host', '<hostname>') UNSET ('xsengine','instances') WITH RECONFIGURE;

    ALTER SYSTEM ALTER CONFIGURATION ('topology.ini', 'system') UNSET ('/host/<hostname>', 'xsengine')  WITH RECONFIGURE;

    ALTER SYSTEM ALTER CONFIGURATION ('topology.ini', 'system') UNSET ('/volumes', '<volume_id>')  WITH RECONFIGURE;

    ALTER SYSTEM ALTER CONFIGURATION ('daemon.ini', 'host', '<hostname>') SET ('xsengine','instances') = '1' WITH RECONFIGURE;

    Then restart the HANA instance and after that make a full backup (and schedule the regular backup in order to prevent this situation again).

    Hope this will help someone like me :-).

    Have a nice day.



  • Hi Thomas,

    In need of your expert advice.

    I have a situation where I am using BO Dashboards to create my Dashboard which is consuming the data from HANA.

    I have a requirement to allow the user to comment in the dashboard and it will write back to the HANA DB and also display the comments in the Dashboard.

    In order for the BO Dashboard to write back to HANA DB is via web services.

    Is there any way i can create a WSDL URL and consume the XSJS or ODATA services in HANA?

  • Hi,

    Very nice blog.

    Similar fashion i need to consume xsoda in java application.

    Can anyone please suggest me steps.


    Sumit Arora.

  • Hi Thomas,

    I want to learn more about the xsengine's session handling, which appears to be different than the indexserver sessions, I would find in M_CONNECTIONS and M_SESSION_CONTEXT.

    SAP HANA XS Administration Tool unfortunately only allows limited control.

    The reason is that we face this error in the xsengine tracefiles on a regular basis:

    Session creation failed. Maximum number of sessions (50000) reached on

    But we only got a hand full of developers accessing the HDB system through xsengine for some xsodata services.

    I tried to find a table/view where I would see these sessions, but I

    was not able to find any....perhaps it is hidden and not even possibly

    to query it for security reasons (it could even be in a encrypted file

    on OSlevel).

    Here is what I mean:

    When you logon to HANA XS, after the initial authentication, you get a

    xsSessionId cookie.

    On every call to a non public XSengine service, a string like this is




    2FformLogin; jstree_load=; jstree_selestyle='font-family:courier'

    style='font-family:courier' style='font-family:courier' ct=%





    This runs against sap.hana.xs.formLogon.checkSession.xsjs:

    var ret = {

    "login": false,

    "pwdChange": false,


    $.response.contentType = "application/json";

    $.response.status = 200;

    function checkLocation() {

    var location = $.request.parameters.get("x-sap-origin-location");


    if (location) {

    var exp = new RegExp(/^[\/][^\/\\][^\\]*$/);

    if (!exp.test(location)) {

    ret["x-sap-origin-location-ok"] = false;


    return false;


    ret["x-sap-origin-location-ok"] = true;


    return true;


    if(checkLocation()) {

    var username = $.session.getUsername();

    if (username !== "") {

    ret.login = true;

    ret.pwdChange = $.session.isPwdChangeNeeded();

    ret.username = username;




    For every future authentication, this xsSessionId cookie is being used.

    You can test this:






    And all info my browser did send was this:

    Request sent 86 bytes of Cookie data:



    If you call the same without a cookie, you get:


    So there must be a mapping between the sessionID and the User connected

    to it...and the number of these entries is limited to 50.000 by the

    maxsessions parameter.

    The question I would have now:

    - Is there a possibility to count the number of sessions?

    - Can we check if the sessions get removed once someone closes the

    browser or deletes these cookies?

    - Is there an automatic process that removes inactive sessions after

    XYZ minutes or will it only take care of this when we set the

    sessiontimeout parameter?

    Thank you


    • XS Sessions are only for sticky authentication and shouldn't need any special monitoring.  I don't know of any tools that will monitor them. You really shouldn't be getting the error that you exceeded the maximum sessions, especially with a small number of users on the system. I suggest you open a support ticket for the root cause of the issue.

      • Hi Thomas,

        I already did that (call 234273 / 2015 ), but unfortunately I was advised to check M_CONNECTIONS and M_SESSION_CONTEXT, which did not explain the background (since these are indexserver sessions).

        As solution I was asked to increase the xssessions parameter, but I'd want to understand the way HANA handles these 'sticky authentication' sessions better, since we face this on a development system with 20-30 users right now but in our future production we will see 8000 users.

        My fear is that the 'sticky authentication' sessions on the xs do not get cleaned when a user simply closes it's browser. But if I can not gather any information about these sessions, I will not be able to perform a test and identify the issue.

        Thanks & regards


        • It sounds to me like support did not address the root cause of the problem. Why the sessions remain or why you have an abnormally large number of sessions. I would suggest reopening the ticket as not having solved your problem. As you said, their solution of looking at M_CONNECTIONS or M_SESSION_CONTEXT isn't even a correct answer.

          • Hi Thomas, I am spinning in circles back and forth with my SAP call (185352/2015) and it almost reached a point where I give up explaining my issue. Would you have any chance to help me to get this call to someone who understands what I am asking? I cannot be explaining it that incorrectly since you actually understood me on my first comment. I would be very thankfull

            Thanks and regards


          • There is very little I can do. I'm not part of the support organization and can't even make comments in your ticket. All I can really do is try and send a polite email to one of the support managers and ask them if they can take a second look at the issue.

  • Hello Thomas,


    The 2-tier application architecture mentioned above is also supported in XSA?

    Appreciate for your help.





    • What is described here is now called XS Classic. It is still shipped alongside XSA for backwards compatibility.  However it will be removed at some point in the future.  XSA is not a 2-tier approach as described here. It is more of a traditional 3-tier architecture.

  • Thank Thomas for your comment.

    I understand the relation between 2 "versions" now.


    Really appreciate for your reply.


    Best regards,