How does CSRF token works in deployed UI5 APP

[former_member134135]

I have developed a UI5 program that can update data through OData model.

When it runs locally, there is no problem with GET method and POST method.

However, if I deploy the same program as a HTML5 APP, GET method is OK but POST method occurred 403 error.

It seems like CSRF token is incorrect.

I guess maybe XSUAA changed the value of CSRF token?

because of both local run and postman run always get short tokens,

instead of the long token when deploy and run.

The following are the relevant settings.

Please help me to fix my deployed program, many thanks.

Destination:

xs-app.json:

manifest.json:

[mariusobert]

I'd say this is the intended behavior as you don't set the header explicitly. As a explanation:

When running locally, CSRF is not enforced. This explains why it works.

GET works in the deployed version because CSRF only affects state-changing operations.

[inesmartins]

How did you solve it? I have the same problem

[junwu]

check if these parameters help when you set it to your odatamodel

earlyTokenRequest: true,
tokenHandling: true,