403 Forbidden , cl_http_client=>create_by_destination

[Aisurya]

Hi Experts,

Getting error while POST of an OData service. Seems X-CSRF-Token is invalid.

 CALL METHOD cl_http_client=>create_by_destination
    EXPORTING
      destination              = 'BPMODATA'
    IMPORTING
      client                   = lo_http_client.

*STEP 2:- Fill headers and set URI for GET Method

  lv_uri = 'bpmodata/startprocess.svc/test.com/test~process~bpm/Purchase_Group/StartData'.

  CALL METHOD cl_http_utility=>set_request_uri
    EXPORTING
      request = lo_http_client->request
      uri     = lv_uri.

* set Content type
  CALL METHOD lo_http_client->request->set_content_type
    EXPORTING
      content_type = 'application/json'.

*      * set header field for fetching X-CSRF token


   CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'X-CSRF-Token'
      value = 'Fetch'.

  CALL METHOD lo_http_client->request->set_method
    EXPORTING
      method = lo_http_client->request->co_request_method_get.

*Step 3:- Trigger the GET Method

  lo_http_client->send(
 EXCEPTIONS
   http_communication_failure = 1
   http_invalid_state         = 2 ).

  lo_http_client->receive(
    EXCEPTIONS
      http_communication_failure = 1
      http_invalid_state         = 2
      http_processing_failed     = 3 ).

  CALL METHOD lo_http_client->response->get_header_field
    EXPORTING      
      name  = 'X-CSRF-Token'     
   RECEIVING      
    value = l_token.

*  Step 4:- Fill headers and Body for HTTP POST method

CALL METHOD lo_http_client->request->set_header_field
  EXPORTING
    name  = 'X-CSRF-Token'
    value = l_token.

 CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Cache-Control'
      value = 'no-cache'.

  CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Connection'
      value = 'keep-alive'.

  CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Accept-Language'
      value = 'en-US,en;q=0.8'.

  CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Accept'
      value = 'application/json'.

  CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Content-Type'
      value = 'application/json'.

CALL METHOD lo_http_client->request->set_header_field
    EXPORTING
      name  = 'Accept-Encoding'
      value = 'gzip, deflate'.


CALL METHOD lo_http_client->request->set_method
  EXPORTING
    method = lo_http_client->request->co_request_method_post.

   CALL METHOD lo_http_client->request->get_header_fields
     CHANGING
       fields =  lt_hdrs .  " Header fields


* create Body for the HTTP Post request

l_body = '{"ProcessStartEvent": {"::StartBPM":{"PurchaseGroup_StartBPM":{"Request_Id":"901","Country":"IN" }}}}'.

CALL METHOD lo_http_client->request->set_cdata
  EXPORTING
    data = l_body.

CALL METHOD lo_http_client->request->get_cdata
  RECEIVING
    data =  lv_getcdata   

lo_http_client->send(
    EXCEPTIONS
      http_communication_failure = 1
      http_invalid_state         = 2 ).

*      “Send the HTTP request
lo_http_client->receive(
  EXCEPTIONS
    http_communication_failure = 1
    http_invalid_state         = 2    http_processing_failed     = 3 ).

*    “receive the response

lv_result = lo_http_client->response->get_cdata( ).

   CALL METHOD lo_http_client->response->get_header_fields
    CHANGING
       fields =  lt_hdrsresponse .  " Header fields

Getting 403 Forbidden error. Request your help.

Thanks in advance,

Aisurya

[UweFetzer_se38]

Do you really get the 403 on the POST or already on the GET? Maybe the path on your BPM server is not active.

Can you replicate the error thru an external REST client like Postman or similar?