{"ref":"content:building-secure-sapui5-applications-best-practices-for-developers","page":"/content/building-secure-sapui5-applications-best-practices-for-developers","json":"/content/building-secure-sapui5-applications-best-practices-for-developers.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"building-secure-sapui5-applications-best-practices-for-developers","title":"Building Secure SAPUI5 Applications: Best Practices for Developers","url":"https://community.sap.com/t5/technology-blog-posts-by-sap/building-secure-sapui5-applications-best-practices-for-developers/ba-p/14267269","content_type":"blog","published_on":"source:sap-community","explains":[{"ref":"capability:linting","applies_to":{"ecosystems":["ui5"]}},"capability:input-validation"],"summary":"A developer-facing rundown of secure coding habits for SAPUI5 apps: typed bindings and custom formatters to reject bad input before it reaches a handler, encodeHTML() instead of rendering untrusted HTML, keeping tokens and URLs out of local and session storage, and CSRF token handling on the ODataModel. It sets up [linting](capability:linting) with ESLint and an eslint-config-ui5 rule set to catch unsafe DOM access, eval calls and unused imports as part of CI, alongside the same [input validation](capability:input-validation) instinct: reject invalid input early rather than trust the backend to catch it.","short":"Secure coding habits for SAPUI5 apps","author":"Manisha_19","published":"2025-12-10","provenance":{"discovered_via":[{"source":"source:sap-community","channel":"sapui5-tag"}],"first_seen":"2026-09-19"},"drafted_with_ai":true,"history":[{"date":"2026-10-17","field":"explains","from":null,"to":"applies_to on capability:linting (ui5)","reason":"Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md)."}]},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"good","evidence":"published 10 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"good","evidence":"no recorded change after 2025-12-10"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":1816,"unit":"views"},{"value":0,"unit":"comments"},{"value":6,"unit":"likes"}]},"signals":{"views":1816,"likes":6,"comments":0,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}