Question Re: Hide url Parameters in Technology Q&A

Hide url Parameters

velsankar_sundar — Wed, 23 Jul 2014 11:16:16 GMT

Hi Team,

Is it possible to hide the url parameters, when the gateway service is executed through UI5. For example from the below url is it possible to hide the parameter agencynum in the browser while it is passed to UI5.

/sap/opu/odata/IWFND/RMTSAMPLEFLIGHT/TravelagencyCollection(agencynum='00001756') .

Re: Hide url Parameters

ChandrashekharMahajan — Wed, 23 Jul 2014 11:22:29 GMT

Hi,

you can query it as below,

/sap/opu/odata/IWFND/RMTSAMPLEFLIGHT/TravelagencyCollection('00001756')

Regards,

Chandra

Re: Hide url Parameters

sreehari_vpillai — Wed, 23 Jul 2014 11:24:09 GMT

Hi Sundar,

You can not hide the agencynum parameter(yes you can do it, if there is only one key-as suggested by ). This is part of OData protocol. No donuts ofor you

Sreehari

Re: Hide url Parameters

AshwinDutt — Wed, 23 Jul 2014 11:33:23 GMT

Hello Sundar,

If you have too many keys in your model then no. not possible.

Only one key, then yes. send the value in quotes as Chandra suggested.

Regards,

Ashwin

Re: Hide url Parameters

velsankar_sundar — Wed, 23 Jul 2014 12:19:16 GMT

Hi all,

I think you all misunderstood the question. I am asking whether i can hide or make it invisible (agencynum='00001756') as a whole.

So, that the enduser can not see anything, which is passed.

Re: Hide url Parameters

sreehari_vpillai — Wed, 23 Jul 2014 12:21:24 GMT

H Sundar,

No you can not do it. Its the part of OData protocol.

Sreehari

Re: Hide url Parameters

ChandrashekharMahajan — Wed, 23 Jul 2014 12:25:53 GMT

Hi,

end user can see the whole source code as well as can see query request made in Network tab of chrome developer console (F12).

and just from $metadata, end user will be able to see the complete EDM structure of OData service.

Regards,

Chandra

Re: Hide url Parameters

former_member200392 — Wed, 23 Jul 2014 20:34:07 GMT

Hi chandra,

My client doesn't want to show url parameters in network tab or the console. Is there any other mechanism that we can use to hide url parameters? Otherwise how can we ensure no one hacks the application by using the url parameter. Please provide details. Your comments will really help me.

Regards,

S.vikgnesh

Re: Hide url Parameters

sreehari_vpillai — Thu, 24 Jul 2014 04:47:01 GMT

Hi , ,

Providing the key values in the GET operation is part of OData protocol, which can not be hidden in any case.But, you can try the below alternatives,

Encrypt the key from back end pass it to the front end so that customer never see the original key ( draw back is to create a mapping table with original key and encrypted key-remember routing in FIORI)
do POST instead of GET so that , no URL parameters are included. All the data will be in HTTP body

Sreehari

Re: Hide url Parameters

former_member200392 — Thu, 24 Jul 2014 05:41:26 GMT

Hi sreehari,

I actually looked for this alternatives. Now its clear for me.

Thanks alot.

Regards,

S.Vikgnesh

Re: Hide url Parameters

sreehari_vpillai — Thu, 24 Jul 2014 05:43:25 GMT

Welcome

Re: Hide url Parameters

ChandrashekharMahajan — Thu, 24 Jul 2014 05:47:07 GMT

Hi,

as mentioned in earlier response, end user is able to see your entire code as well as how the HTTP calls are being made to server in browser developer console tools (valid for almost all browsers having ability to open the console)

yes the other option could be encryption of the code but it has its own disadvantages. you can google on it. here is one good discussion javascript - Disable developer tools - Stack Overflow follow entire discussion to know more on pros and cons.

There is one concept javascript obfuscator. try http://javascriptobfuscator.com/

Here is example of JS code with obfuscator - JS Bin - Collaborative JavaScript Debugging</title> <link rel="icon" href="http://static.jsbin.…

and original example as JS Bin - Collaborative JavaScript Debugging</title> <link rel="icon" href="http://static.jsbin.…

I hope this will give some idea on encoding. but again it has its own disadvantages and need to use properly.

Regards,

Chandra

Re: Hide url Parameters

velsankar_sundar — Thu, 24 Jul 2014 08:28:57 GMT

Hi All,

I just got to go through this link in sdn. It says how to handle confidential data in Odata urls

https://help.sap.com/saphelp_gateway20sp06/helpdata/en/b1/455fa3c3b14e4c9dc0d514f135bf87/content.htm?frameset=/en/e4/d75…

Re: Hide url Parameters

sreehari_vpillai — Thu, 24 Jul 2014 08:30:52 GMT

POST

Re: Hide url Parameters

Former Member — Sun, 27 Jul 2014 17:31:58 GMT

Dear Experts,

Could any one please guide me to handle the following scenario.

1.Passing values to OData get request as request body instead URL parameters from UI5.

(i.e)instead passing like this ../XXXService/XXEnitySet?$filter=(XXX EQ '000)

is it possible to pass like this .../XXXService/XXXEntitySet

Request Body:

...

<XXX>000<XXX>

...

and getting the same in getEntitySet as a parameters.Something like post request,but this request calls the createEntity Method.

Dear Sreehari,

Could you please explain how to achieve this.

"do POST instead of GET so that , no URL parameters are included. All the data will be in HTTP body".
but it should not trigger createEntity method.

Thanks & Regards,

Rumeshbabu S

Re: Hide url Parameters

RB777 — Tue, 22 Sep 2020 15:02:49 GMT

Link opens blank page