{"ref":"content:understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta","page":"/content/understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta","json":"/content/understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta.json","generated":"2026-10-30","drafted_with_ai":true,"entity":{"id":"understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta","title":"Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.","url":"https://community.sap.com/t5/technology-blog-posts-by-members/understanding-security-approaches-in-sap-cap-using-xsuaa-in-node-js-flavor/ba-p/13430605","content_type":"blog","explains":[{"ref":"capability:authorization","applies_to":{"ecosystems":["btp","cap"]}},{"ref":"capability:authentication","applies_to":{"ecosystems":["btp","cap"]}}],"summary":"The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — [@sap/xssec](artifact:sap-xssec) and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.","short":"XSUAA security in CAP Node.js from the MTA descriptor outward","author":"balbinosoares","published":"2020-03-16","sources":[{"url":"https://community.sap.com/t5/technology-blog-posts-by-members/understanding-security-approaches-in-sap-cap-using-xsuaa-in-node-js-flavor/ba-p/13430605","title":"Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA. — SAP Community","checked":"2026-09-08"}],"provenance":{"discovered_via":[{"source":"source:sap-community","channel":"cap-tag"}],"first_seen":"2026-09-08"},"drafted_with_ai":true,"published_on":"source:sap-community","history":[{"date":"2026-10-17","field":"explains","from":null,"to":"applies_to on capability:authorization (cap, btp); capability:authentication (cap, btp)","reason":"Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md)."}]},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"poor","evidence":"published 79 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"poor","evidence":"CAP Java 3.7.1, 2025-01 and 2 more"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":17461,"unit":"views"},{"value":8,"unit":"comments"},{"value":24,"unit":"likes"}]},"signals":{"views":17461,"likes":24,"comments":8,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}