Production Architectural Blueprint

SAP BTP MTA & Approuter Architecture Guide

Architectural Domain: Side-by-Side Application Packaging Runtime: SAP BTP Cloud Foundry Standard: MTA Specification 3.2

1. The Foundation of Side-by-Side Packaging: MTA

In SAP BTP, modern cloud applications rarely consist of a single executable. A typical enterprise extension comprises an SAP Fiori Elements frontend, an application router reverse proxy, an XSUAA identity service instance, a Destination service instance, and optional microservices (CAP Node.js / Java).

The Multi-Target Application (MTA) specification provides a declarative framework (mta.yaml) that orchestrates the build order, dependency resolution, and atomic deployment of all heterogeneous components into SAP BTP Cloud Foundry.

2. Managed Approuter vs Standalone Approuter: The Architecture Decision

The Application Router (Approuter) serves as the single entry point for all web traffic, orchestrating authentication with XSUAA, CSRF token handling, and URL reverse-proxying. In modern architectures, architects choose between two deployment models:

Evaluation Vector	Managed Approuter (SAP Build Work Zone)	Standalone Approuter (Custom CF App)
Hosting Infrastructure	Fully managed serverless service by SAP	Dedicated Node.js container on Cloud Foundry
Compute Cost	Zero CF memory quota consumed	Consumes 256MB–512MB CF RAM per instance
Maintenance	Automatic zero-downtime security patches	Customer manages npm dependencies & security CVEs
Custom Logic	Not supported (configuration via xs-app.json only)	Supported via custom Node.js middleware extension
SAP Recommendation	Standard Recommendation (Clean Core)	Specialized use-cases only (custom session headers)

3. Reverse-Proxy Routing & CSRF Governance in xs-app.json

Every route in xs-app.json must be configured with precision to avoid security leaks or cross-site request forgery vulnerabilities:

{
  "welcomeFile": "/index.html",
  "authenticationMethod": "route",
  "routes": [
    {
      "source": "^/sap/opu/odata/(.*)$",
      "target": "/sap/opu/odata/$1",
      "destination": "S4HANA_CLEAN_CORE",
      "authenticationType": "xsuaa",
      "csrfProtection": true
    },
    {
      "source": "^(.*)$",
      "target": "$1",
      "service": "html5-apps-repo-rt",
      "authenticationType": "xsuaa"
    }
  ]
}

4. Enterprise XSUAA Security Profile: xs-security.json

The XSUAA descriptor declares the identity perimeter of the application. In multi-tenant SaaS or dedicated enterprise deployments, scopes must follow the $XSAPPNAME.<scope> naming convention to prevent cross-app privilege escalation:

{
  "xsappname": "com.corp.order.extension",
  "tenant-mode": "dedicated",
  "description": "Security profile for Clean Core extension",
  "scopes": [
    {
      "name": "$XSAPPNAME.Admin",
      "description": "Administrative privileges in extension"
    }
  ],
  "role-templates": [
    {
      "name": "AdminRole",
      "description": "Grants Admin authorizations",
      "scope-references": [
        "$XSAPPNAME.Admin"
      ]
    }
  ]
}

5. Clean Core CI/CD Pipeline Integration

Production deployments must be executed through automated CI/CD runners (GitLab CI, GitHub Actions) using the official Cloud MTA Build Tool (mbt) and Cloud Foundry Deploy plugin (cf deploy):

# 1. Assemble artifacts into a deployable MTAR archive
mbt build -t ./mta_archives --mtar com.corp.order.extension.mtar

# 2. Deploy atomically to Cloud Foundry space
cf deploy ./mta_archives/com.corp.order.extension.mtar --delete-services --force

6. Architectural Anti-Patterns to Avoid

• Anti-Pattern 1: Hardcoding S/4HANA URLs: Never put full URLs in xs-app.json or UI code. Always resolve destinations dynamically through the Destination service.
• Anti-Pattern 2: Disabling CSRF Protection: Setting csrfProtection: false on mutating routes bypasses S/4HANA ICF gateway security, causing 403 Forbidden errors or opening CSRF vulnerabilities.
• Anti-Pattern 3: Massive Monolithic MTAs: Avoid combining dozens of unrelated Fiori apps into a single MTA archive. Package applications into domain-bounded MTAs to isolate release lifecycles.