Hide url Parameters

[velsankar_sundar]

Hi Team,

            Is it possible to hide the url parameters, when the gateway service is executed through UI5. For example from the below url is it possible to hide the parameter agencynum in the browser while it is passed to UI5.

/sap/opu/odata/IWFND/RMTSAMPLEFLIGHT/TravelagencyCollection(agencynum='00001756') .

[Former Member]

Dear Experts,

Could any one please guide me to handle the following scenario.

1.Passing values to OData get request as request body instead URL parameters from UI5.

     (i.e)instead passing like this ../XXXService/XXEnitySet?$filter=(XXX EQ '000)

          is it possible to pass like this .../XXXService/XXXEntitySet

          Request Body:

               ...

                    <XXX>000<XXX>

               ...

          and getting the same in getEntitySet as a parameters.Something like post request,but this request calls the createEntity Method.

Dear Sreehari,

Could you please explain how to achieve this.

"do POST instead of GET so that , no URL parameters are included. All the data will be in HTTP body".
but it should not trigger createEntity method.

Thanks & Regards,

Rumeshbabu S

[velsankar_sundar]

Hi All,

I just got to go through this link in sdn. It says how to handle confidential data in Odata urls

https://help.sap.com/saphelp_gateway20sp06/helpdata/en/b1/455fa3c3b14e4c9dc0d514f135bf87/content.htm...

[sreehari_vpillai]

POST

[RB777]

Link opens blank page

[sreehari_vpillai]

Hi , ,

Providing the key values in the GET operation is part of OData protocol, which can not be hidden in any case.But, you can try the below alternatives,

• Encrypt the key from back end pass it to the front end so that customer never see the original key ( draw back is to create a mapping table with original key and encrypted key-remember routing in FIORI)
• do POST instead of GET so that , no URL parameters are included. All the data will be in HTTP body

Sreehari

[former_member200392]

Hi sreehari,

I actually looked for this alternatives. Now its clear for me.

Thanks alot.

Regards,

S.Vikgnesh

[sreehari_vpillai]

Welcome

[velsankar_sundar]

Hi all,

      I think you all misunderstood the question. I am asking whether i can hide or make it invisible (agencynum='00001756') as a whole.

So, that the enduser can not see anything,  which is passed.

[sreehari_vpillai]

H Sundar,

No you can not do it. Its the part of OData protocol.

Sreehari

[ChandraMahajan]

Hi,

end user can see the whole source code as well as can see query request made in Network tab of chrome developer console (F12).

and just from $metadata, end user will be able to see the complete EDM structure of OData service.

Regards,

Chandra

[former_member200392]

Hi chandra,

My client doesn't want to show url parameters in network tab or the console. Is there any other mechanism that we can use to hide url parameters? Otherwise how can we ensure no one hacks the application by using the url parameter. Please provide details. Your comments will really help me.

Regards,

S.vikgnesh

[ChandraMahajan]

Hi,

as mentioned in earlier response, end user is able to see your entire code as well as how the HTTP calls are being made to server in browser developer console tools (valid for almost all browsers having ability to open the console)

yes the other option could be encryption of the code but it has its own disadvantages. you can google on it. here is one good discussion javascript - Disable developer tools - Stack Overflow follow entire discussion to know more on pros and cons.

There is one concept javascript obfuscator. try http://javascriptobfuscator.com/

Here is example of JS code with obfuscator - JS Bin - Collaborative JavaScript Debugging&lt;/title&gt; &lt;link rel=&quot;icon&quot; href=&quot;h...

and original example as JS Bin - Collaborative JavaScript Debugging&lt;/title&gt; &lt;link rel=&quot;icon&quot; href=&quot;h...

I hope this will give some idea on encoding. but again it has its own disadvantages and need to use properly.

Regards,

Chandra

[AshwinDutt]

Hello Sundar,

If you have too many keys in your model then no. not possible.

Only one key, then yes. send the value in quotes as Chandra suggested.

Regards,

Ashwin

[sreehari_vpillai]

Hi Sundar,

You can not hide the agencynum parameter(yes you can do it, if there is only one key-as suggested by ). This is part of OData protocol. No donuts ofor you

Sreehari

[ChandraMahajan]

Hi,

you can query it as below,

/sap/opu/odata/IWFND/RMTSAMPLEFLIGHT/TravelagencyCollection('00001756')

Regards,

Chandra