No Authentication in Backend Destination about sap-cf-destination

[vobu]

Currently is is referring to the "Basic Authentication" credentials maintained in the SAP backend in the Destination service. Basically, whatever the API/OData from the backend destination is exposed to cloud, there's no prompt for backend authorization, anyone can access to the data.

actually no - you need to reference valid xsuaa-, connectivity- and destination instances in the manifest. Those provide OAuth tokens that are then used to query the BE resource. For programmatic use, it might look as if there's no authorization involved; but the token handling is happening internally in SAP CP cf.

Is there plan to add Basic Authentication check if username and password is not added to the CF Destination cockpit?

I haven't actually tested this myself (didn't have the requirement; that's why the module is also labeled "alpha" :) ), but I'm using credentials for a destination if they are configured in the CF cockpit