[SAP BYD - HELP] CSRF token validation failed

[ixdse]

Hi Expert,

I have a problem below when I Patch to oData.

• The first time, I Get oData with HeaderParam. It returns status 200.
• Then I got HeaderParam "x-csrf-token" with the value which I GET it in the result and I Patch the Odata. It returns status 403 Forbidden.
• I got an error "CSRF token validation failed" when I Patch It, I have tested it before in Postman it was successful.
• I have tried many times like adding Cookies and changing the method Patch,... but it's not successful.

All my code I wrote in one script file, and I call GET, PATCH Odata at the same time.
P/s: So how can I fix it? I hope my question can be slove.
Thanks and Best Regards

[ixdse]

Hi I have a similar issue. We are getting a 404 with this error message:

The server has not found any resource matching the Data Services Request URI.

We are doing a POST request to an odata service (khemployeetime) SubmitToApproval action. An other request to the same service is working, but this not.

submittoapproval is working in Postman when getting the token in Postman by executing the GET of khemployeetime.

I tried your solution but there are multiple issues:

first I do not get the token when executing in ABSL code. When I try this in Postman it works fine to get the token.

When I hard code the token in ABSL that I got from Postman I get the error 404 with the error message.

Do you have any clue?

I think it has nothing todo with authorization more then getting the request available in ABSL.

Is there somewhere something different when requesting an action?

[ThiagoSarmento]

Hello hoangtridung2405,

The 403 Forbidden error means that there is a cookie issue.

So after you receive and store the cookies from GET call, and send them on POST call, you would need to also set the "HTTP_Secure_Cookie" parameter with value 256 or 257

• 256: do not perform URL encoding of the cookie value, do not set the secure attribute
• 257: do not perform URL encoding of the cookie value, do set the secure attribute

This is required as the underlying framework performs a decoding of the cookie.
Please refer to the following SAP Note: https://launchpad.support.sap.com/#/notes/3302847

I hope this helps!

Best regards,

Thiago