Refresh CSRF token for MDK client/application

[#1]

Hello experts,

We noticed, that sometimes our MDK application receives an HTTP exception from the backend:

Error: com.sap.cloud.mobile.odata.http.HttpException: https://ilobmwui-dev-scm-ewm-ilo-rtop-dd.cfapps.sap.hana.ondemand.com; Caused by: com.sap.cloud.mobile.odata.core.RuntimeIOException; Caused by: java.io.IOException: No CSRF token found in response.

The reason is clear: CSRF token is expired, because it is set to 30 minutes at the backend. Now I am looking for a way to refresh this token without logout and logon again. Following documentation and instructions how to use CSRF, I tried to put header parameter "X-CSRF-Token" with value "fetch" to the request, but this does not help.

I am wondering is there any standard way to refresh this token with any MDK API, or what you can recommend in this case?

Note: ServiceOption requiresToken is not even activated explicitly is or service metadata. I checked clientAPI.getODataProvider("/rtop/Services/tour.service") for any service related method but its methods are very limited

Any hint, recomendation, suggestion will be highly appretiatedBest Regards,Dimiter

[mingkho]

Hi Dimiter

Typically, MDK will take care of refreshing the CSRF token.

And based on the error you are seeing: "No CSRF token found in response", it seems to fail when MDK is trying to refresh the CSRF token. You will only get this error when MDK is trying to refresh the CSRF token by sending a CSRF Fetch request to your backend but receive no CSRF token back from your backend.

So my suggestion will be for you to check the network trace in your backend and see why your backend is not returning the CSRF token.

Regards

Ming

[dimiter_dimitrov2]

Hello Ming,

Thank you for the explanation. I understand what happens, and I think I know the reason why backend is not returning the CSRF token. The validity of this token is set to 30 min. The misbehaviour happens when the token is expired.

However, I am not able to trace a call which is supposed to refresh the token. According to this article I should expect a non-modifying request GET:

https://help.sap.com/docs/SAP_NETWEAVER_740/68bf513362174d54b58cddec28794093/b35c22518bc72214e100000...

Would you tell me more details about how MDK refreshes the token? Is it done by the client or by the BTP mobile services? What is the access point of the URL used by MDK to retrieve new token? I need it in order to know what object to filter in the traces at the backend system.

PS: I tried to enforce the token refresh using predefined action of type Action.Type.VerifyPasscode, but after passcode was verified I received the same error

Best Regards,

Dimiter

[mingkho]

Hello Dimiter,

The URL with Fetch should be the Server URL of your Mobile Service instance. But after discussion with our team, we suspect there might be a bug with this.

Can you raise a ticket on this with all the details so that we can reproduce the exact same issue with your project and investigate it.

Regards

Ming

[prashanthgurram18]

Hi Ming,

We are facing same issue, but in an intermittent manner. Was there any resolution to this?

Regards,

Prashanth