Question Re: CAP NodeJS: CSURF package deprecated in Technology Q&A

CAP NodeJS: CSURF package deprecated

AlessandroB — Mon, 18 Dec 2023 11:42:25 GMT

Hello,

we are developing a CAP application (node.js) and a SAPUI5 application with managed approuter as a frontend that consume ODATA V2 from my CAP by a destination.

Following the best practices page (https://cap.cloud.sap/docs/node.js/best-practices#securing-your-application), I came across the CSRF token topic with the manual implementation.

Reading the documentation it is suggested to install the "csurf" package. Clicking on the provided link (https://www.npmjs.com/package/csurf) I discover that this is a deprecated package.

What other library will need to be used to maintain compatibility with the CAP application and SAPUI5 apps?

Thanks
Alessandro

Re: CAP NodeJS: CSURF package deprecated

gregorw — Mon, 18 Dec 2023 13:58:21 GMT

Hi Alessandro,

looking at the Approuter documentation for routes:

https://github.com/gregorwolf/SAP-NPM-API-collection/tree/main/apis/approuter#routes

you find the csrfProtection setting which is by default true. So if you haven't changed it to false in your xs-app.json for the managed approuter you should already have a CSRF protection for your CAP Backend that is provided in the approuter.

Best Regards
Gregor

Re: CAP NodeJS: CSURF package deprecated

AlessandroB — Tue, 19 Dec 2023 17:11:58 GMT

Hi Gregor,

thanks for your response but i think i have a different scenario.

I don't have any xs-app.json file or approuter configuration on my CAP project.

My SAPUI5 application is located in another project (only Fiori application with managed approuter) with the xs-app.js file.

So, SAPUI5 application use a destination to call ODATA from CAP using the URL coming from the srv module on CAP.

Is it possible to enable this control for this scenario as well?

Thanks,

Alessandro

Re: CAP NodeJS: CSURF package deprecated

gregorw — Tue, 19 Dec 2023 17:27:26 GMT

As you have an xs-app.json in the UI5 Project that uses the CAP Backend via the destination you can also have CSRF protection there.