Loading
search-img
Title
Three ways to secure your FlexNet Manager Application server
FlexNet Manager Suite installations rely on IIS for hosting the web interface. Because installations can run on varied IIS versions and configurations, only minimal IIS configuration is applied during setup. It is your responsibility to ensure IIS meets your organization’s security standards. This article outlines key considerations for securing IIS in FlexNet Manager environments.
Key security principles for IIS hosting FlexNet Manager Suite:
  • Use HTTPS: Configure all production environments to use HTTPS endpoints. Avoid exposing HTTP endpoints once initial testing is complete. Instructions for enabling HTTPS vary by IIS version; refer to official IIS documentation for guidance.
  • Avoid co-hosting in IIS: Best practice is to dedicate IIS exclusively to FlexNet Manager Suite (and optionally the inventory beacon). Co-hosting with other applications increases the risk of cookie handling and security vulnerabilities. Where co-hosting is unavoidable, configure FlexNet Manager under a unique sub-domain or unique sub-path.
Cookie security recommendations:
  • Ensure cookies include secure attributes such as:
    • Secure – restricts cookies to HTTPS connections.
    • HttpOnly – prevents cookies from being accessed via client-side scripts.
    • SameSite=Strict or SameSite=Lax – reduces risk of cross-site request forgery attacks.
  • Domain and Path values should be as specific as possible. If you co-host, configure sub-domains or sub-paths for cookie isolation.
Important header configurations:
  • Add Cache-Control with value no-store (combine with private, max-age=0, or s-maxage=0 if required by your testing tools).
  • Validate that other relevant headers and cookie attributes meet organizational security standards.
Disable HTTP TRACE method:
TRACE can expose HttpOnly cookies in certain circumstances. Disable the TRACE verb for the FNMS application site using IIS Manager or by adding the following entry in the site’s web.config:
 
 
 
 
 
 
XML
 
 
 
<security>
 
<requestFiltering>
 
<verbs>
 
<add verb="TRACE" allowed="false" />
 
</verbs>
 
</requestFiltering>
 
</security>
Show more lines
Implementation tips:
  • IIS allows adding headers and rewriting cookies either through UI or by editing Web.config files. For cookie attributes such as Secure or SameSite, outbound rules in web.config using the IIS rewrite module may be required.
  • Multiple FlexNet Manager Suite components have separate Web.config files (for example, under %InstallDir%\WebUI\, %InstallDir%\SAP\Portal\, and others).
  • Make changes at the parent site level when possible, or apply settings to child applications individually.
Additional recommendations:
  • Keep IIS modules and patches up to date.
  • Disable unnecessary modules.
  • Configure dynamic IP restrictions.
  • Use penetration testing tools for validation.
Outcome:
Applying these guidelines helps ensure that the IIS configuration for FlexNet Manager Suite aligns with best practices for security, reducing risks from misconfiguration or outdated defaults.
Was this helpful?
Support Hub
Create a case with Support
0/255
Upload Attachment
File Upload
Maximum file size allowed is 3 MB.
File type not supported.
Supported file types:
Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to cancel the case creation?

Are you sure you want to close this case

Get Hotline support
Products Region Phone Numbers
FlexNet Operations
FlexNet Embedded
FlexNet Publisher
FlexNet Connect
FlexNet Code Insight
InstallAnywhere
InstallShield 		North America  * +1 630-332-2513 (toll)
+1 877-279-2853 (toll-free in North America)
Europe  * +44 1925 944367 (toll)
+44 800 047 8642 (toll-free in Europe)
Japan  * +81 3-4540-5335 (select option 2)
Australia  * +61 3 9895 2177
+61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics)
Compliance Intelligence 		Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.
Book an Appointment
File Upload
Maximum file size allowed is 3 MB.
File type not supported.
Supported file types:
Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Revenera Assistant

Revenera Assistant
+1.800.374.4353
CONTACT US REVENERA.COM FLEXERA.com
© 2026 Flexera Software. All Rights Reserved.
Privacy policy Terms and conditions Flexera Community Contact Us
Loading
Three ways to secure your FlexNet Manager Application server