Trainer for Secure UI5 & CAP/CDS Development Wanted - 1 Day Remote

Project overview

Your contact person for this request

Kerstin Ufer

Tel.: [contact removed]

E-Mail: [contact removed]

By using the masculine form of the word "consultant / developer etc.", all genders female/male/diverse are meant

With this request, we are looking for a trainer for Secure UI5 & CAP/CDS Development

Activity:

Conducting training with the following content

Developer Training: Secure UI5 & CAP/CDS Development

1-day intensive agenda for secure coding in the SAP environment

Module 1: Understanding the UI5 Attack Surface

Module 2: Client-Side Security & UI5 Controls

Module 3: The "Zero Trust" Principle for APIs & CDS Services

Module 4: Session, Token & Context Management

Module 5: Best Practices & Tooling for Daily Development

Project Language:

German

Utilization:

1 day training + possibly creation/revision of materials

Fee:

please state your daily rate

Payment Term:

30 days

Other

• Focus: How attackers analyze your app and gather specific information.
• Hands-on: Using Browser DevTools and the UI5 Diagnostic Tool (Ctrl+Alt+Shift+S) to reveal the structure, models, and sensitive data directly in memory (RAM).
• Defense: Minimizing productive logging information, hiding test data in productive releases, and securing configuration files (manifest.json).
• Focus: Specifically preventing input validation and Cross-Site Scripting (XSS) in the frontend.
• Hands-on: Exploiting custom formatters or custom controls that render HTML content unfiltered (e.g., via sap.ui.core.HTML or insecure string concatenation).
• Defense: Correct escaping with sap.base.security.encodeXML/HTML, using secure standard controls (sap.m.Text), and implementing a Content Security Policy (CSP) specifically for UI5.
• Focus: Why the UI5 frontend never serves as a security barrier and how CAP services are secured at their core.
• Hands-on: Manipulating values (e.g., prices, status fields) directly in the HTTP request. Bypassing client-side attributes like visible="false" or editable="false".
• Defense (CAP/CDS Focus): Declarative access control directly in the service definition (.cds). Using @requires for role-based security (RBAC) and implementing Access Control / ACS (@restrict) for instance-based authorizations (e.g., row-based tenant separation).
• Focus: CSRF protection, JWT validation, and secure user context in CAP.
• Hands-on: Attempting to make unauthorized API calls to the CAP application via manipulated JSON Web Tokens (JWT) or missing CSRF protection.
• Defense: Correct connection of the XSUAA service on SAP BTP, validation of JWT tokens in the Node.js/Java backend of CAP, and automatic evaluation of the user context ($user) within the CDS security rules.
• Focus: Automation and continuous code quality in the CI/CD process.
• Content: Integration of security linters (like ESLint with UI5 plugins) directly into the IDE, static analysis of CDS files for missing security annotations (CAP linter), and an open final discussion on your current cloud architecture challenges.

Project details

asap

Duration / End

1 day

If you can support us in this matter, please send us suitable profiles.

Please remember to provide the CV as a Word file with your offer.

Furthermore, please be so kind as to state the fee or confirm the fee guideline.

Start / End

Utilization

1 day training + possibly creation/revision of materials

Payment Term

30 days

Fee

please state your daily rate

Other

If you can submit a qualified offer for this request, please send us a meaningful profile, including a concrete statement on availability and conditions. Please note that we will use the data you provide exclusively for the purpose of mediating project assignments in accordance with §5 BDSG. Disclosure to third parties within this scope will only occur after obtaining your consent. Thank you in advance for your support.

• Start: asap
• Remote: remote
• Location: Remote, DE
• Languages: German