Integrate CSRF Tokens

Overview

CSRF (Cross Site Request Forgery) Tokens help to prevent CSRF attacks. The tokens are defined by the card developer in the configuration part of the manifest and can be resolved by the application with the help of sap.ui.integration.Host. The host application developer can override the getCsrfToken method that resolves the CSRF Token configuration to a Promise which further resolves its value. The card calls this function to resolve a token in a request that needs it.

Example

Controller
var MyHostClassName = sap.ui.integration.Host.extend("MyHostClassName", { });

MyHostClassName.prototype.getCsrfToken = function (mCsrfTokenConfig) {
	var sTokenValue = "randomTokenValue"; // fetch the correct value

	return Promise.resolve(sTokenValue);
};

var oHost = new MyHostClassName();

this.getView().byId('card1').setHost(oHost);
XML View
<mvc:View xmlns:w="sap.ui.integration.widgets">
	<w:Card id="card1" manifest="./manifest.json" />
</mvc:View>