abap2UI5

Appearance

Go-Live Checklist ​

This is the go-live checklist. Technically, abap2UI5 is an HTTP handler: a package of ABAP classes and interfaces and one table, behind an ICF node. Run it the way any other HTTP service of the system is run.

A fresh installation starts without any configuration. Some of its defaults are chosen for that first start and not for production. Work through the list below once per system, then use the table under Operating It to find the page for each later task.

Before Go-Live ​

Every row names what to do, where to do it and how to see that it worked. Rows 2 to 5 are fields of the user exit, a class of your own; the complete class is below.

#WhatWhereHow to verify
1Restrict who may call the endpointSICF: a value in SAP Authorization on the node; PFCG: a role with S_ICF - Authorizationa user without the role gets the not authorized page of the ICF, a user with it gets the app
2Load UI5 from a source you control, with a fixed versioncs_config-src in set_config_http_get - Bootstrappingthe page source (Ctrl+U) shows your URL in the <script id="sap-ui-bootstrap"> tag
3Hide error details from the browsercs_config-check_hide_error_details = abap_true in set_config_http_postan app that raises an exception answers Internal Server Error, without the exception chain
4Send the Content Security Policy as a response headeran entry Content-Security-Policy in cs_config-t_security_header - Securitythe network tab of the browser (F12) shows the header on the page request
5Decide whether to trust X-Forwarded-Hostcs_config-check_trust_forwarded_host in set_config_http_post: keep abap_true behind a web dispatcher or reverse proxy, set abap_false without one - Securityan app still answers a click; a 403 CSRF validation failed means the setting does not fit your proxy
6Install a release, not main, and write the version downabapGit: pull a release tag - Versioning, Upgradethe system information of the start page shows the abap2UI5 version

Why each row matters:

  • Row 1. By default everyone with a logon reaches the node. The node is the outer check; the app's main( ) is the inner one.
  • Row 2. The default is the public CDN with the newest UI5. A CDN serves the whole JavaScript runtime into a logged-on session, and the newest version can change without notice.
  • Row 3. By default the error response shows the full exception chain, including the public attributes of the exception classes.
  • Row 4. By default the policy is a <meta> tag. The browser enforces a header earlier, before it reads the page.
  • Row 5. The setting is on by default so that a proxy works at once. Any client can send that header, so an installation without a proxy switches the setting off.
  • Row 6. The security policy supports the latest release only. Small, regular upgrades keep each step easy.

With the Admin Cockpit installed, its security traffic light checks rows 3 to 5 for you: green means done.

A Production User Exit ​

Copy this class into a package of your own, not into the abap2UI5 packages, and adjust the three numbered values. The framework finds the class by its interface; nothing has to be registered.

abap
CLASS zcl_my_production_exit DEFINITION PUBLIC.

  PUBLIC SECTION.
    INTERFACES z2ui5_if_ui5_exit.

  PROTECTED SECTION.
  PRIVATE SECTION.
ENDCLASS.

CLASS zcl_my_production_exit IMPLEMENTATION.

  METHOD z2ui5_if_ui5_exit~set_config_http_get.

    " row 2 - (1) UI5 from this system; or a CDN URL with a version in it
    cs_config-src = `/sap/public/bc/ui5_ui5/resources/sap-ui-core.js`.

    " row 4 - (2) the policy as a header; add the host UI5 comes from
    "         when it is not this system
    APPEND VALUE #(
        n = `Content-Security-Policy`
        v = `default-src 'self' data: blob:; `             &&
            `script-src 'self' 'wasm-unsafe-eval'; `       &&
            `style-src 'self' 'unsafe-inline'; `           &&
            `img-src 'self' data: blob:; `                 &&
            `connect-src 'self'; worker-src 'self' blob:; ` &&
            `object-src 'none'; base-uri 'self'; `         &&
            `frame-ancestors 'self'` )
        TO cs_config-t_security_header.

  ENDMETHOD.

  METHOD z2ui5_if_ui5_exit~set_config_http_post.

    " row 3
    cs_config-check_hide_error_details = abap_true.

    " row 5 - (3) abap_true behind a web dispatcher or reverse proxy
    cs_config-check_trust_forwarded_host = abap_false.

  ENDMETHOD.

ENDCLASS.

After you activate the class, reload the page and check rows 2 to 5 as the table says. If the page stays white, open the browser console (F12): a blocked script names the directive of the policy that refused it.

What an Installation Consists Of ​

ObjectWhat it isWhere it comes from
The framework package and its sub-packagessrc/00 external libraries, src/01 the engine and the embedded frontend, src/02 the released API, src/99 the frozen compatibility packagean abapGit pull of a release tag
Table Z2UI5_T_01the table of the app drafts: the saved app instance between two roundtrips, client-dependent, one row per roundtrippart of the package (src/01/01)
An HTTP handler class and an ICF nodea class of yours calling z2ui5_cl_ui5_http_handler=>run( ), entered in the handler list of a node in SICFcreated on each system - see the Quickstart
A user exit classa class of yours implementing z2ui5_if_ui5_exit, in a package of your own; it carries the production settings aboveyour package - see User Exits
BSP Z2UI5the frontend as an app in the UI5 ABAP repository, pulled from the frontend repositoryonly when apps run as launchpad tiles or in a Fiori elements host
The monitor tables Z2UI5_T_CK_*the Admin Cockpit's own tablesonly when the cockpit is installed

The ICF node serves the frontend itself: the page request carries the whole embedded UI5 app, and UI5 is loaded from the bootstrap source the exit names. An installation without a launchpad has no frontend deployment of its own. The words roundtrip and app draft are explained in the Glossary.

How a Release Is Tested ​

Every release is checked on NetWeaver 7.02, on Standard ABAP and on ABAP Cloud, and in the browser on UI5 1.71 and on the current UI5 release. These checks run without an SAP system. What they cannot prove is your system: that a transport activates on your kernel, that your ICF node is configured, that a browser behind your proxy loads the page. Reports from real systems are collected on the framework's Verified on page. There is no fixed release cadence; the changelog shows when each release shipped.

Operating It ​

TaskPage
Move the installation from development to production: which objects travel in which order, what is set per systemTransport, Landscape
Upgrade, stay on a release, roll back; what is stable APIVersioning, Upgrade
Find the cause when something breaks; recurring housekeepingBasis Runbook
Estimate work processes and the growth of the draft tableSizing
Understand the security model: data flow, CSP, response headers, CSRFSecurity
Decide who may start which appAuthorization
See whether abap2UI5 is used, fast and safely configuredMonitoring
Make a slow roundtrip fasterPerformance
Set breakpoints, read the developer tools and the error overlayDebugging
End every session of a user at logoutLogout
Run a second installation beside the first, under another prefixNamespaces, Renaming

Transport ​

abap2UI5 ships as ABAP objects and goes to production through the transport process you already have. The order of the transports and a picture of the landscape are on Transport, Landscape.