Retrieved destination doesn't contain authTokens

Hello all,

since I upgraded the @sap-cloud-sdk package from 1.53.x/1.54.x to 2.4.0, I’m facing the issue that retrieved destination does not include any authTokens although the forwardAuthToken property is set to true.

To clarify the problem, I have attached code and screenshots below of how the application behaved before and after the upgrade.

I am not sure if this is really an issue or if the behaviour is so desired. I wanted to report the behaviour anyway to find out if I am doing something wrong. If the behaviour is as desired as described below, can you tell me what I’m doing wrong or what I need to do differently to get authTokens with the destination?

Kind regards Johannes

---

Definition of destination in “User-Provided Variables” in the BTP

[ {
     "forwardAuthToken" : true,
     "name" : "myDestination",
      "url" : "https://<my-url>.cfapps.eu10.hana.ondemand.com"
} ]

Old behaviour

Used: version: "@sap-cloud-sdk/core": "1.53.1"

Calling the getDestination method:

	import * as coreCloud from "@sap-cloud-sdk/core";
	[...]
        const foundDestination = await coreCloud.getDestination("myDestination", {
             userJwt: <valid-user-token>,
             useCache: true,
	});
	[...]

Response:

As you can see authTokens array is filled.

New behaviour

Used: version: "@sap-cloud-sdk/connectivity ": "2.4.0"

Calling the getDestination method:

	import * as connectivityCloud from "@sap-cloud-sdk/connectivity";
	[...]
        const foundDestination = await connectivityCloud.getDestination({
             destinationName: "myDestination",
             jwt: <valid-user-token>,
             useCache: true,
	});
	[...]

Response:

As you can see authTokens array is not filled.

My finding

I debugged the sources of the two versions of the sdk. And it looks like that the part where the authTokens are added to the destination is not implemented in the new version.

Old implementation

New implementation

Used Versions:

• node version: v14.19.2
• npm version: 6.14.17
• SAP Cloud SDK version: "@sap-cloud-sdk/connectivity ": "2.4.0"

[FrankEssenberger]

Good morning @thisisevanfox,

here my first thoughts:

• Can you help me out to get rid of my confusion? The registerDestination adds the destination to a key value store or cache if you want to call it that way. When you call then getDestination it will look at the env variable first, then the register destination cache and last the actual destination service. When a destination with the given name is found the flow is stopped and the result is returned. In the latest security validation it was pointed out that it is not a good practice to store destinations in environment variables because people could store too sensitive information in the environment. Therefore we introduced the register method and the env is stell there, but really meant for local test purpose.
• Where to call registerDestination? Once at server start should be fine and you must do it before the first getDestiantion or executeHttpRequest call.
• After calling registerDestination do I still need to call getDestination The executeHttpRequest does a lookup (calls getDestination) of the destination if you provide the DestinationFetchOption with the name of the registered destination. So you can directly use: executeHttpRequest({destinationName: 'nameOfRegisteredDestination', jwt: 'myJwtToPropagate')

I hope this helps.

Best Frank

[FrankEssenberger]

Thanks for the feedback. I close it and create a back log item to improve documentation.