SCP: How to use ODATA services without basic authentication?

[former_member475246]

Hello experts,

I have created a JAVA application that generates my ODATA service. The application is linked to a scheme that I have created. I have also added roles to access it.

From this url generated from my ODATA, I have created a destination to be consumed in a sapui5 application. Here I put the basic authentication property.

I have deployed the SAPUI5 project calling the target and everything has worked correctly. Now what is the problem? The problem is that if you put the url of the sapui5 project and add the path that refers to the destination, you can access it without having to authenticate to ODATA. I have tested it clearing the cache and in the browser incognito mode and it can be accessed without the need for authentication.

<url of the sapui5 application>/<destination route>/$metadata

Here is the configuration of my destination in my Sapui5 project and how I call it.

I want to prevent this from happening, I want only the queries and procedures to be made within the views and controllers of the SAPUI5 project. That is why I would like to know if there is any form of authentication more private and limited to only linked projects.

Is there any other safer way to use ODATA services?

Thank you

[gregorw]

If you implement your service using CAP Service SDK for Java you get great guidance how to secure your application. I think you should lear about SAP Approuter and JWT.