CAP NodeJS: CSURF package deprecated

[AlessandroB]

Hello,

we are developing a CAP application (node.js) and a SAPUI5 application with managed approuter as a frontend that consume ODATA V2 from my CAP by a destination.

Following the best practices page (https://cap.cloud.sap/docs/node.js/best-practices#securing-your-application), I came across the CSRF token topic with the manual implementation.

Reading the documentation it is suggested to install the "csurf" package. Clicking on the provided link (https://www.npmjs.com/package/csurf) I discover that this is a deprecated package.

What other library will need to be used to maintain compatibility with the CAP application and SAPUI5 apps?

Thanks
Alessandro

[gregorw · Accepted solution]

Hi Alessandro,

looking at the Approuter documentation for routes:

https://github.com/gregorwolf/SAP-NPM-API-collection/tree/main/apis/approuter#routes

you find the csrfProtection setting which is by default true. So if you haven't changed it to false in your xs-app.json for the managed approuter you should already have a CSRF protection for your CAP Backend that is provided in the approuter.

Best Regards
Gregor

[AlessandroB · Accepted solution]

Hi Gregor,

thanks for your response but i think i have a different scenario.

I don't have any xs-app.json file or approuter configuration on my CAP project.

My SAPUI5 application is located in another project (only Fiori application with managed approuter) with the xs-app.js file.

So, SAPUI5 application use a destination to call ODATA from CAP using the URL coming from the srv module on CAP.

Is it possible to enable this control for this scenario as well?

Thanks,

Alessandro

[gregorw · Accepted solution]

As you have an xs-app.json in the UI5 Project that uses the CAP Backend via the destination you can also have CSRF protection there.