How to solve the error "CSRF token validation failed” when calling an API?

[Kelly_Hannel]

The error "CSRF token validation failed” is raised when you try to access an API via Postman.

You want to know how to resolve this error.

[Kelly_Hannel · Accepted solution]

Hello Community,

In order to solve the error "CSRF token validation failed” you need to fetch the the CSRF token.

To do it, please follow the below steps:

1- Using GET go to Headers tab and add:

KEY = x-csrf-token VALUE = fetch

2- Press send.

3- The token will be generated at Header tab. Then you need copy the token and change for the field value "fetch".

Please refer to the image "CSRF" attached.

4- After that you will be able to use the POST method.

Hope it helps!

[srikanthvadla · Accepted solution]

Thanks Kelly ! May i know the reason why we need to do that, is it due to an update in PostMan version ? I have create many odata services before but i did not face this issue before. Can you please help to understand little more ?

[Marco6 · Accepted solution]

Thank you, I also resolved the issue.
In my case, the error started after applying authentication policies to my test API.
II applied the parameters at the header level, there were a couple of failures, but then the error disappeared.

[MauricioSantos]

Changing the Default CSRF Protection Mechanism

To change the default CSRF protection mechanism, proceed as follows:

1. Go to transaction SICF.

2. Navigate to the ICF node for your service.

3. Double-click your service node.

4. On Service Data choose GUI Configuration.Caution

5. Enter the following values:

   • Parameter Name: ~CHECK_CSRF_TOKEN

   • Parameter Value: 0/1 (disable/enable)

     Compatiblity Mode for SP02 - HTTP Handler in SICF (node sdata)

     ( Default : X-Requested-With, to enable XSRF check use, ~CHECK_CSRF_TOKEN=1)

     The request handler is /IWFND/CL_SDATA_ODATA_APP.

     Standard Mode - HTTP Handler in SICF (node odata)

     ( Default: XSRF check, to disable and switch to X-Requested-With, use ~CHECK_CSRF_TOKEN=0)

     The request handler is /IWFND/CL_SODATA_HTTP_HANDLER.

6. Choose Continue and save your settings.

[madalinaghinescu]

In my case, this solution worked. From POSTMAN side, no need to add a new parameter. The token validation can be adjusted from the back-end service.

[khabir_komm_one]

I have also faced the same problem with our new S/4HANA System. I have disabled CSRF Token for a specific OData service in SICF by following the SAP Note.

https://me.sap.com/notes/2751277/en-US

https://help.sap.com/docs/SAP_NETWEAVER_740/68bf513362174d54b58cddec28794093/b35c22518bc72214e100000...

[gunnare]

Nice! Thank you for posting this solution

[former_member810551]

I am getting a error "CSRF token validation failed" using a Tcode: /n/IWFND/GW_CLIENT

Do you have any ideia to fix?

Thanks a lot

Rodolfo.

[vikram_putta]

Hi Rodolfo,

could you please let me know how did you solve the error "CSRF token validation failed" in SAP Gateway?

i'm also facing the same error even though i have csrf-token in my post request. Your inputs will be very helpful.

Thanks

Vikram