## 4.1.4.2.2.10  Environment Variables
A list of environment variables that can be used to configure the application router.
The following table lists the environment variables that you can use to configure the application router. The table also provides a short description of each variable and, where appropriate, an example of the configuration data.
Application Router Configuration Variables
| Variable     | Description                                                                                             |
|--------------|---------------------------------------------------------------------------------------------------------|
| httpHeaders  | Configures the application router to return additional HTTP headers in its responses to client requests |
| destinations | Provides information about the available application (microservice) destinations.                       |
Variable
## Description
<!-- image -->
| cookies [page 500]           | The application router generates the following third-party cookies and sends them to the client: • locationafterLogin • fragmentAfterLogin • signature • JSESSION ID To control the behavior and usage of the third-party cookies, you can configure the attributes SameSite and Partitioned . For more information about third-party cookies, please see the KBA 3409306 .   |
|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SESSION_TIMEOUT              | Sets the time to trigger an automatic central log out from the User Account and Authentication (UAA) server.                                                                                                                                                                                                                                                                  |
| SEND_XFRAMEOPTIONS           | Sets or changes the X-Frame-Options header                                                                                                                                                                                                                                                                                                                                    |
| CJ_PROTECT_WHITELIST         | A list of allowed server or domain origins to use when checking for click-jacking attacks.                                                                                                                                                                                                                                                                                    |
| WS_ALLOWED_ORIGINS           | A list of the allowed server (or domain) origins that the application router uses to verify requests.                                                                                                                                                                                                                                                                         |
| JWT_REFRESH                  | Configures the automatic refresh of the JSON Web Token (JWT) provided by the User Account and Authentication (UAA) service to prevent expiry (default is 5 minutes).                                                                                                                                                                                                          |
| UAA_SERVICE_NAME             | Specifies the exact name of the UAA service to bind to an application.                                                                                                                                                                                                                                                                                                        |
| INCOMING_CONNECTION_TIM EOUT | Specifies the maximum time (in milliseconds) for a client connection. If the specified time is exceeded, the connection is closed.                                                                                                                                                                                                                                            |
| TENANT_HOST_PATTERN          | Defines a regular expression to use when resolving tenant host names in the request's host name.                                                                                                                                                                                                                                                                              |
| COMPRESSION                  | Configures the compression of resources before a response to the client.                                                                                                                                                                                                                                                                                                      |
| SECURE_SESSION_COOKIE        | Configures the enforcement of the Secure flag of the application router's session cookie.                                                                                                                                                                                                                                                                                     |
| REQUEST_TRACE                | Enables additional traces of the incoming and outgoing requests.                                                                                                                                                                                                                                                                                                              |
| EXTERNAL_REVERSE_PROXY       | Indicates the use of the application router behind an external reverse proxy outside of the Cloud Foundry domain. For more information, see Customer Header under Headers [page 479].                                                                                                                                                                                         |
| CORS                         | Provides support for cross-origin requests, for example, by allowing the modification of the request header.                                                                                                                                                                                                                                                                  |
<!-- image -->
| Variable                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| DIRECT_ROUTING_URI_PATT ERNS | Defines a list of URIs that are directed to the routing configuration file (xs-app.json file) of the application router instead of to a specific applicaion's xs-app.json file that is stored in the HTML5 Application Repository. This configuration improves the applica- tion loading time and monitoring options.                                                                                                                                                                                                             |
| EXT_SESSION_MGT              | You can configure external session management. See External Session Management [page 509].                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| CF_NODEJS_LOGGING_LEVEL      | Sets the minimal logging level of the cf-nodejs-logging-support library of the application router.                                                                                                                                                                                                                                                                                                                                                                                                                                |
| STATE_PARAMETER_SECRET       | Enables the use of state parameters to prevent CRFS attacks. If this environment variable is set, the application router creates a state parameter for each initial authorization request. By validating that the authentication server returns the same state parameter in its response, the application server can verify that the response did not originate from a third party.                                                                                                                                               |
| HTTP2_SUPPORT                | Enables the application router to start as an HTTP/2 server.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| FULL_CERTIFICATE_CHAIN       | Enables the application router to send the entire chain of certificates provided in the binding of the authentication service (XSUAA or Indentity Authentication) to the back- end applications. The certificates are required for mutual TLS authentication (mTLS handshake). See Mutual TLS Authentication (mTLS) and Certificates Handling [page 509].                                                                                                                                                                         |
| OWN_SAP_CLOUD_SERVICE        | An array that contains the business solutions ("SAP cloud services") that your HTML5 applications are associated with as values. This configuration enables the standalone application router to use the same standardized format for runtime URLs ( /<sap.cloud.service>.<appId>-<versionId>/ ) that is also used by the managed application router. If a runtime URL contains one of the defined values in the <sap.cloud.service> section, the application router will recognize the value during the processing of a request. |
## Description
| DYNAMIC_IDENTITY_PROVIDER   | Configures a dynamic identity provider. If DYNAMIC_IDENTITY_PROVIDER is set to true, the end user can set the identity provider (IDP) for the application's login process. If SAP Authorization and Trust Man- agement is used, the sap_idp request query parameter must be filled with the IDP origin key. If Identity Authentication is used, the sap_idp request query parameter must be filled with the name of the corporate identity provider configured in the ad- ministration console for SAP Cloud Identity services. Note that this is not the display name , but the name of the corporate identity provider (see Creating URL To Access Application with Specific Identity Provider ). If the identityProvider property is defined in the route [page 455], its value will be overwritten by the sap_idp query parameter value. The default value for DYNAMIC_IDENTITY_PROVIDER is false .   |
|-----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
## httpHeaders
If configured, the application router sends additional HTTP headers in its responses to a client request. You can set the additional HTTP headers in the &lt;httpHeaders&gt; environment variable. The following example configuration shows how to configure the application router to send two additional headers in the responses to the client requests from the application &lt;myApp&gt; :
```
cf set-env <myApp> httpHeaders "[ { \"X-Frame-Options\": \"ALLOW-FROM http:// example.com\" }, { \"Test-Additional-Header\": \"1\" } ]" or cf set-env <myApp> httpHeaders '[{ "X-Frame-Options": "ALLOW-FROM http:// example.com" }, { "Test-Additional-Header": "1" }]'
```
##  Tip
To ensure better security of your application set the Content-Security-Policy header. This is a response header which informs browsers (capable of interpreting it) about the trusted sources from which an application expects to load resources. This mechanism allows the client to detect and block malicious scripts injected into the application. A value can be set via the &lt;httpHeaders&gt; environment variable in the additional headers configuration. The value represents a security policy which contains directive-value pairs. The value of a directive is an allowlist of trusted sources.
Usage of the Content-Security-Policy header is considered second line of defense. An application should always provide proper input validation and output encoding.
## destinations
The destinations configuration is an array of objects that is defined in the destinations environment variable. A destination is required for every application (microservice) that is part of the business application. The following table lists the properties that can be used to describe the destination:
Destination Environment Variable Properties
| Property         | Type    | Mandatory   | Description                                                                                                                                                                                                                                                                                                                                           |
|------------------|---------|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| name             | String  | Yes         | A unique indentifier for the destination                                                                                                                                                                                                                                                                                                              |
| url              | String  | Yes         | The Unique Resource Locator for the applica- tion (microservice)                                                                                                                                                                                                                                                                                      |
| proxyHost        | String  | No          | The host of the proxy server used in case the request should go through a proxy to reach the destination.                                                                                                                                                                                                                                             |
| proxyPort        | String  | No          | The port of the proxy server used in case the request should go through a proxy to reach the destination.                                                                                                                                                                                                                                             |
| forwardAuthToken | Boolean | No          | If true, the OAuth token will be sent to the des- tination. The default value is 'false'. This token contains the user identity, scopes, and some other attributes. The token is signed by the User Account and Authorization (UAA) service so that the token can be used for user-authen- tication and authorization purposed by back- end services. |
| strictSSL        | Boolean | No          | Configures whether the application router should reject untrusted certificates. The de- fault value is 'true'.                                                                                                                                                                                                                                        |
|                  |         |             |  Caution For testing purposes only. Do not use this property in production environments!                                                                                                                                                                                                                                                             |
| Property                | Type    | Mandatory   | Description                                                                                                                                                                                                                                                  |
|-------------------------|---------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| timeout                 | Number  | No          | A positive integer representing the maximum amount of time to wait for a response (in mil- liseconds) from the specified destination. The default is 30000ms.                                                                                                |
| proxyType               | String  | No          | Indicates if the destination is used to ac- cess applications in private networks (for ex- ample, on-premise) or publicly available on the Internet. Possible value: onPremise . If proxyType is not specified, the default (In- ternet access) is assumed.  |
| IASDependencyName       | String  | No          | Configures the name of the Identity Authenti- cation dependency that is used to exchange the Identity Authentication token used for the user authentication at login. If configured, the exchanged token is then also forwarded to the backend applications. |
| forwardAuthCertificates | Boolean | No          | If true , the certificates and key of the authen- tication service are added to the HTTP con- nection to the destination. The default value is false . For more information see: Mutual TLS Authentication (mTLS) and Certificates Handling [page 509]       |
If true , the certificates and key of the authentication service are added to the HTTP connection to the destination. The default value is false . For more information see: Mutual TLS Authentication (mTLS) and Certificates Handling [page 509]
The following example shows a simple configuration for the &lt;destinations&gt; environment variable:
```
 Sample Code [ { "name" : "ui5", "url" : "https://sapui5.example.com", "proxyHost" : "proxy", "proxyPort" : "8080", "forwardAuthToken" : false, "timeout" : 1200 } ]
```
It is also possible to include the destinations in the manifest.yml file, as illustrated in the following example:
```
 Sample Code - name: node-hello-world memory: 100M path: web env: destinations: > [ {"name":"ui5", "url":"https://sapui5.example.com"} ]
```
## Additional Cookie Attributes
If configured, the application router sends additional cookie attributes in its responses to the client. Additional cookies attributes can be set in the &lt;COOKIES&gt; environment variable.
Example of configuration for cookies in the manifest.yml :
```
 Sample Code env: COOKIES: > { "SameSite":"None", "Partitioned": { "supportedPartitionAgents":"^Mozilla.*(Chrome|Chromium|)/ ((109)|(1[1-9][0-9])|([2-9][0-9][0-9]))", "unsupportedPartitionAgents":"PostmanRuntime/7.29.2" } }
```
In this example, the application router sets the SameSite attribute of the cookie to None and the specifies a Partitioned attribute that is sent in the responses to the client.
##  Note
Currently, only the values None and Lax are supported for the SameSite attribute. The value Strict is not supported.
The Partitioned attribute contains two required regular expressions:
- supportedPartitionAgents for supported agents
- unsupportedPartitionAgents for unsupported agents
You can use a wildcard '(.*)' in supportedPartitionAgents to allow all agents to use the Partitioned attribute.
##  Note
unsupportedPartionAgents overwrites the configurations in supportedPartitionAgents . If an agent is allowed in supportedPartitionAgents but disallowed in unsupportedPartitionAgents , the Partitioned attribute will not be returned.
## SESSION\_TIMEOUT
You can configure the triggering of an automatic central log-out from the User Account and Authentication (UAA) service if an application session is inactive for a specified time. A session is considered to be inactive if no requests are sent to the application router. The following command shows how to set the environment variable &lt;SESSION\_TIMEOUT&gt; to 40 (forty) minutes for the application &lt;myApp1&gt; :
```
cf set-env <myApp1> SESSION_TIMEOUT 40
```
##  Note
You can also set the session timeout value in the application's manifest.yml file, as illustrated in the following example:
##  Sample Code
```
- name: myApp1 memory: 100M path: web env: SESSION_TIMEOUT: 40
```
##  Tip
If the authentication type for a route is set to "xsuaa" (for example, "authenticationType": "xsuaa" ), the application router depends on the UAA server for user authentication, and the UAA server might have its own session timeout defined. To avoid problems caused by unexpected timeouts, it is recommended that the session timeout values configured for the application router and the UAA are identical."
## SEND\_XFRAMEOPTIONS
By default, the application router sends the X-Frame-Options header with the value ' SAMEORIGIN '. Y ou can change this behavior either by disabling the sending of the default header value (for example, by setting
SEND\_XFRAMEOPTIONS environment variable to false) or by overriding the value, for example, by configuring additional headers (with the &lt;httpHeaders&gt; environment variable).
The following example shows how to disable the sending of the X-Frame-Options for a specific application, myApp1 :
cf set-env &lt;myApp1&gt; SEND\_XFRAMEOPTIONS false
## CJ\_PROTECT\_WHITELIST
The &lt;CJ\_PROTECT\_WHITELIST&gt; specifies a list of origins (for example, host or domain names) that do not need to be protected against click-jacking attacks. This list of allowed host names and domains are used by the application router's allowlist service to protect XS advanced applications against click-jacking attacks. When an HTML page needs to be rendered in a frame, a check is done by calling the allowlist service to validate if the parent frame is allowed to render the requested content in a frame. The check itself is provided by the allowlist service
The following example shows how to add a host name to the click-jacking protection allowlist for the application, myApp1 :
cf set-env &lt;myApp1&gt; CJ\_PROTECT\_WHITELIST {&lt;protocol&gt;, &lt;hostname&gt;, &lt;portNr&gt;}
The content is a JSON list of objects with the properties listed in the following table:
Allowlist of Host and Domain Names
| Property   | Type          | Mandatory   | Description                                                                                                          |
|------------|---------------|-------------|----------------------------------------------------------------------------------------------------------------------|
| protocol   | String        | No          | URI scheme, for example 'HTTP'.                                                                                      |
| host       | String        | Yes         | A valid host name, for example, example.com.hostname , or a domain name defined with an asterisk (*) *.example.com . |
| port       | String/Number | No          | Port string or number containing a valid port.                                                                       |
##  Note
Matching is done against the properties provided. For example, if only the host name is provided, the allowlist service matches all schemata and protocols.
xs set-env &lt;myApp1&gt; CJ\_PROTECT\_WHITELIST {&lt;*.example.com&gt;}
## WS\_ALLOWED\_ORIGINS
When the application router receives an upgrade request, it verifies that the origin header includes the URL of the application router. If this is not the case, then an HTTP response with status 403 is returned to the client. This origin verification can be further configured with the environment variable &lt;WS\_ALLOWED\_ORIGINS&gt; , which defines a list of the allowed origins the application router uses in the verification process.
##  Note
The structure of the &lt;WS\_ALLOWED\_ORIGINS&gt; variable is the same as the variable &lt;CJ\_PROTECT\_WHITELIST&gt; .
```
cf set-env <myApp1> WS_ALLOWED_ORIGINS { <*.example.com> }
```
## JWT\_REFRESH
The JWT\_REFRESH environment variable is used to configure the application router to refresh a JSON Web Token (JWT) for an application, by default, 5 minutes before the JWT expires, if the session is active.
```
cf set-env <myApp1> JWT_REFRESH 1
```
If the JWT is close to expiration and the session is still active, a JWT refresh will be triggered &lt;JWT\_REFRESH&gt; minutes before expiration. The default value is 5 minutes. To disable the automatic refresh, set the value of &lt;JWT\_REFRESH&gt; to 0 (zero).
## UAA\_SERVICE\_NAME
The UAA\_SERVICE\_NAME environment variable enables you to configure an instance of the User Account and Authorization service for a specific application, as illustrated in the following example:
cf set-env &lt;myApp1&gt; UAA\_SERVICE\_NAME &lt;myUAAServiceName&gt;
##  Note
The details of the service configuration are defined in the &lt;VCAP\_SERVICES&gt; environment variable, which is not configured by the user.
## INCOMING\_CONNECTION\_TIMEOUT
The INCOMING\_CONNECTION\_TIMEOUT environment variable enables you to set the maximum time (in milliseconds) allowed for a client connection, as illustrated in the following example:
```
cf set-env <myApp1> INCOMING_CONNECTION_TIMEOUT 60000
```
If the specified time is exceeded, the connection is closed. If INCOMING\_CONNECTION\_TIMEOUT is set to zero (0), the connection-timeout feature is disabled. The default value for INCOMING\_CONNECTION\_TIMEOUT is 120000 ms (2 min).
## TENANT\_HOST\_PATTERN
The TENANT\_HOST\_PATTERN environment variable enables you to specify a string containing a regular expression with a capturing group. The requested host is matched against this regular expression. The value of the first capturing group is used as the tenant Id. as illustrated in the following example:
```
cf set-env <myApp1> TENANT_HOST_PATTERN
```
## COMPRESSION
The COMPRESSION environment variable enables you to configure the compression of resources before a response to the client, as illustrated in the following example:
```
cf set-env <myApp1> COMPRESSION
```
Here is a complete example of the compression environment variable:
```
 Sample Code env: COMPRESSION: > { "enabled": true, "minSize": 2048, "compressResponseMixedTypeContent": true }
```
## SECURE\_SESSION\_COOKIE
The SECURE\_SESSION\_COOKIE can be set to true or false . By default, the Secure flag of the session cookie is set depending on the environment the application router runs in. For example, when the application router is running behind a router that is configured to serve HTTPS traffic, then this flag will be present. During local development the flag is not set.
##  Note
If the Secure flag is enforced, the application router will reject requests sent over unencrypted connections.
The following example illustrates how to set the SECURE\_SESSION\_COOKIE environment variable:
```
cf set-env <myApp1> SECURE_SESSION_COOKIE true
```
## REQUEST\_TRACE
You can enable additional traces of the incoming and outgoing requests by setting the environment variable &lt;REQUEST\_TRACE&gt; ' true '. If enabled, basic information is logged for every incoming and outgoing request to the application router.
The following example illustrates how to set the REQUEST\_TRACE environment variable:
```
cf set-env <myApp1> REQUEST_TRACE true
```
##  Tip
This is in addition to the information generated by the Node.js package @sap/logging that is used by the XS advanced application router.
## CORS
The CORS environment variable enables you to provide support for cross-origin requests, for example, by allowing the modification of the request header. Cross-origin resource sharing (CORS) permits Web pages from other domains to make HTTP requests to your application domain, where normally such requests would automatically be refused by the Web browser's security policy.
Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources on a Web page to be requested from another domain (protocol and port) outside the domain (protocol and port) from which the first resource was served. The CORS configuration enables you to define details to control access to your application resource from other Web browsers. For example, you can specify where requests can originate from or what is allowed in the request and response headers. The following example illustrates a basic CORS configuration:
```
[ { "uriPattern": "^\route1$", "allowedMethods": [ "GET" ], "allowedOrigin": [ { "host": "host.example.com", "protocol": "https", "port": 345 } ], "maxAge": 3600, "allowedHeaders": [ "Authorization", "Content-Type" ], "exposeHeaders": [ "customHeader1", "customHeader2" ], "allowedCredentials": true } ]
```
The CORS configuration includes an array of objects with the following properties, some of which are mandatory:
Available Settings for CORS Options
| CORS Property   | Type   | Mandatory   | Description                                                                                                                                                                                                                                                                                                    |
|-----------------|--------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| uriPattern      | String | Yes         | A regular expression (RegExp) representing the source routes to which theCORS configuration applies. To ensure that the RegExp matches the complete path, surround it with ^ and $,f or example, "uriPattern": "^\route1$" . Defaults: none                                                                    |
| allowedOrigin   | Array  | Yes         | A comma-separated list of objects each of which contains a host name, port and protocol that are allowed by the server, for example: [{"host": "www.example.com"}] or [{"host": ".example.com"}] .  Note Matching is case-sensitive. In addition, if no port or pro- tocol is specified, the default is "*" . |
| allowedMethods  | Array  | No          | A comma-separated list of HTTP methods that are al- lowed by the server, for example, "GET", "POST" . If allowMethods is defined but no method is specified, the default "GET", "POST", "HEAD", "OPTIONS" (all) applies.                                                                                       |
| allowedMethods  | Array  | No          |  Tip The specified methods must be upper-case, for example, GET . Matching of the method type is case-sensitive.                                                                                                                                                                                              |
| allowedHeaders  | Array  | No          | A comma-separated list of request headers that are allowed by the server. the default values are as fol- lows: ["Origin", "Accept", "X-Requested- With", "Content-Type", "Access-Control- Request-Method", "Access-Control-Request- Headers"] .                                                                |
| maxAge          | String | No          | A single value specifying the length of time (in seconds) a preflight request should be cached for. A negative value that prevents CORSfilter from adding this response header to the pre-flight response. If maxAge is defined but no value is specified, the default time of '1800' seconds applies.         |
| CORS Property       | Type    | Mandatory   | Description                                                                                                                                                                              |
|---------------------|---------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| exposeHeaders       | Array   | No          | A comma-separated list of response headers that are al- lowed to be exposed. If exposeHeaders is defined but no response header is specified for exposure, no default value is supplied. |
| allowedCredential s | Boolean | No          | A Boolean flag that indicates whether the specified resource supports user credentials. The default setting is 'true'.                                                                   |
It is also possible to include the CORS configuration in either the manifest.yml or the manifest-op.yml file. The code in the following example enables the CORS configuration for any route with a source URI pattern that matches the RegExp ' ^\route1$ ':
```
 Sample Code CORS Configuration in the manifest.yml File - name: node-hello-world memory: 100M path: web env: CORS: > [ { "allowedOrigin":[ { "host":"my_host", "protocol":"https" } ], "uriPattern": "^/route1$" }
```
## DIRECT\_ROUTING\_URI\_PATTERNS
With the direct routing URI patterns configuration, you can define a list of URIs that are directed to the routing configuration file (xs-app.json file) of the application router instead of to a specific application's xs-app.json file that is stored in the HTML5 Application Repository. This configuration improves the application loading time and monitoring options because it prevents unnecessary calls to the HTML5 Application Repository.
The configuration is an array of strings or regular expressions. You have to provide only the first segment in the URL, after the approuter host. For example, for the URL https://&lt;approuter-host&gt;/route1/ index.html , you enter route1 in the direct routing URI patterns array.
```
 Sample Code env: DIRECT_ROUTING_URI_PATTERNS: > ["route1", "^route2$", "route3"]
```
## CF\_NODEJS\_LOGGING\_LEVEL
With the CF\_NODEJS\_LOGGING\_LEVEL variable, you can set the minimal logging level of the c f-nodejslogging-support library of the application router. The following levels are available:
- off
- error
- warn
- info
- verbose
•
debug
- silly
The default value is error .
Here is a sample content for the CF\_NODEJS\_LOGGING\_LEVEL environment variable:
<!-- image -->
## Related Information
Application Router [page 439] Routing Configuration File [page 450]