SAP Gateway Part 4: Paging, Filtering, CSRF and Authorization

📌 KEY POINTS
✅ GET_ENTITYSET must apply $filter, $orderby, $top and $skip in the database SELECT — not after reading everything.
✅ Use io_tech_request_context: get_osql_where_clause_convert, get_top, get_skip, get_orderby.
✅ Fill es_response_context-inlinecount when $inlinecount=allpages is requested.
⚠️ Never disable CSRF protection to "fix" 403 errors; fix the client instead.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Parts 1–3 built and registered a service. The most common production problem of SEGW services: GET_ENTITYSET selects everything and ignores query options. This part fixes that.

━━━━━━━━━━━━━━━━━━━━
▶ 1. THE ANTI-PATTERN
SELECT * FROM zpr_head INTO TABLE et_entityset. — then the framework applies $top/$skip in memory ("generic paging"). With 2 million rows, every list request reads 2 million rows.

━━━━━━━━━━━━━━━━━━━━
▶ 2. READ QUERY OPTIONS FROM THE REQUEST CONTEXT

• WHERE: io_tech_request_context->get_osql_where_clause_convert( ) returns an ABAP SQL WHERE clause built from $filter (property names mapped to ABAP field names). Use it in a dynamic WHERE — it is generated safely by the framework from the model.
• Paging: io_tech_request_context->get_top( ) and get_skip( ).
• Sorting: io_tech_request_context->get_orderby( ) — map to an ORDER BY clause.
• Count: io_tech_request_context->has_inlinecount( ) → run a COUNT with the same WHERE and set es_response_context-inlinecount.
• $select: get_select_with_mandtry_fields( ) if you want to read only requested columns.

━━━━━━━━━━━━━━━━━━━━
▶ 3. SORT BEFORE PAGING
$skip/$top without a stable order return random pages. Always add a default ORDER BY (e.g. by key) when the client sends none.\n\n━━━━━━━━━━━━━━━━━━━━\n▶ 4. CSRF\n• Gateway requires an X-CSRF-Token for modifying requests: clients fetch it with GET + "X-CSRF-Token: Fetch".

• UI5 models do this automatically; custom clients must implement it.
• Disabling CSRF protection for a service (possible via ICF/service settings) opens it to cross-site request forgery — only for tightly controlled technical scenarios with other protection.

━━━━━━━━━━━━━━━━━━━━
▶ 5. AUTHORIZATION

• Service level: S_SERVICE via roles (frontend).
• Business level: AUTHORITY-CHECK in each DPC_EXT method (read → activity 03, create → 01, change → 02, delete → 06), or filter data by authorized organizational units.
• Return a business exception with a clear message on failure.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

1. Replace SELECT * in GET_ENTITYSET with the pattern in the code example.
2. Test $filter, $orderby, $top/$skip and $inlinecount in GW client.
3. Compare runtime with ST05 before and after.
4. Add AUTHORITY-CHECK per operation.

✅ CHECKPOINT: your Gateway services page, filter, count and authorize on the server. RAP module: all topics covered.

A purchase request list app became slower every month. ST05 showed that each request read the entire ZPR_HEAD table (1.8 million rows) because GET_ENTITYSET used SELECT * and relied on generic paging.
The team implemented filtering, sorting, paging and inline count from the request context, with a default sort by key. Response time dropped from 12 seconds to under 300 ms, and memory dumps on the application server during peak hours disappeared.

• SELECT * in GET_ENTITYSET with in-memory paging.
• Paging without a stable ORDER BY.
• Ignoring $inlinecount, so UIs show wrong totals.
• Building WHERE clauses by string concatenation of user input.
• Disabling CSRF protection to fix client errors.
• No business authorization checks in DPC_EXT.

• Push $filter, $orderby, $top, $skip into the SELECT.
• Use the request context helper methods for WHERE and paging.
• Always define a default sort order.
• Implement $inlinecount with the same WHERE.
• Keep CSRF on; check authorization per operation.

Questions: "How do you implement paging and filtering in a SEGW service?", "What is generic paging and why is it a problem?", "How is CSRF handled in Gateway?"
Strong answer: in GET_ENTITYSET read $filter via get_osql_where_clause_convert, $top/$skip via get_top/get_skip, sorting via get_orderby, and apply them in the database SELECT (UP TO / OFFSET, ORDER BY) with a default key order; set es_response_context-inlinecount when requested. Generic paging reads all rows first. CSRF: clients fetch a token and send it with writes; don't disable protection. Check business authorization per operation.