How to POST confidential data in function import?

[Former Member]

Hello,

my SAPUI5 application runs against SAP Gateway. I have written a function import CheckEmployee, originally with method GET, which has some confidential data as input.

An audit resulted in the requirement to not pass the confidential data as URL query parameters. I thought this would be easy by setting the method of the function import to POST. But then I found out that neither Gateway nor SAPUI5 support setting data as request body (payload) in case of a POST function import

SAPUI5 (currently v1.26)   ---   ODataModel-dbg.js:

In method callFunction:

if (sMethod === "GET") {
//            parameters are encoded in read function
    return that.read(sFunctionName, oContext, oUrlParams, true, fnSuccess, fnError);
} else {
    jQuery.each(oUrlParams, function (sParameterName, oParameterValue) {
        // addQuery also encodes the url
        sUrlURI.addQuery(sParameterName, oParameterValue);
    });
    oRequest = this._createRequest(sUrlURI.toString(), sMethod, bAsync);

SAP Gateway (part of NW7.4 SP9)   ---   /IWCOR/CL_DS_PROC_DISPATCHER

In method PROCESS_FUNCTION_IMPORT:

lo_provider =  lo_processor->execute(
io_function_import = io_uri->function_import
it_parameter_value = io_uri->function_import_parameter
iv_format          = lv_format ).

Questions:

1. Do newer versions of UI5 and newer Gateway SPs support POSTing function imports with payload?
2. If not, is it planned to be supported?

[former_member184867 · Accepted solution]

Unfortunately in OData V2 function imports of type POST, payload is not supported.

In OData V4 I think it is allowed, but gateway does not support V4 yet.

[Former Member · Accepted solution]

Hi Atanu,

you are right, SAP follows the OData specification für Service Operations:

If a particular Service Operation takes parameters they should be included as part of the query string in the request URI

[SB9 · Accepted solution]

In SEGW, for function Import I can see GET / POST / Not Specified under the HTTP Column. I have always used GET but I thought that if I selected POST in there it would also work for function import !!