Integrate CSRF Tokens
Overview
CSRF (Cross Site Request Forgery) Tokens help to prevent CSRF attacks.
The tokens are defined by the card developer in the configuration
part of the manifest
and can be resolved by the application with the help of
sap.ui.integration.Host
.
The host application developer can override the getCsrfToken
method that resolves
the CSRF Token configuration to a Promise
which further resolves its value.
The card calls this function to resolve a token in a request that needs it.
Example
Controllervar MyHostClassName = sap.ui.integration.Host.extend("MyHostClassName", { }); MyHostClassName.prototype.getCsrfToken = function (mCsrfTokenConfig) { var sTokenValue = "randomTokenValue"; // fetch the correct value return Promise.resolve(sTokenValue); }; var oHost = new MyHostClassName(); this.getView().byId('card1').setHost(oHost);XML View
<mvc:View xmlns:w="sap.ui.integration.widgets"> <w:Card id="card1" manifest="./manifest.json" /> </mvc:View>