SAP IRPA Ajax Call issue 403 Forbidden Status with CSRF Token Validation Failed in POST method

[srimounika_kadiyala]

Hi,

In IRPA Development , we are integrating the S/4 Service for Post Operation. For this scenario, we are making the first call to receive CSRF Token through Get Operation and getting the Token Successful in response. In the Success Method of Ajax first Call, we are calling the Post Operation with Payload, Request Header like CSRF Token, Authentication & JSON Setting but getting 403 Forbidden Status with CSRF Token Validation Failed in Error Block.

And also we have tested the same service in postman & /IWFND/MAINT_SERVICE, its working fine for GET and POST operation.

In the IWD Trace in S/4 System, Request payload is getting passed correctly but we are unable to validate the Request Header i.e. CSRF Token.

PFB the code:

var user = 'R_*H*_***_GB';

var pass = 'gv63*********sb';

var auth = ctx.base64.encode(user + ":" + pass);

var payload = {

PROCESS_CODE: "STO",

ValidatePoDataSet: [ {

PROCESS_CODE: "STO",

ID_NUM: "01", }]
};
ctx.ajax.call( {

url: 'https://sapfhdaasd001.u***************m:44301/sap/opu/odata/sap/Z*************E_P****TA_SRV',

method: e.ajax.method.get,

contentType: e.ajax.content.json,

usePassport: true,

ignoreClientCertificate:true,

headers: {

'Authorization': "Basic " + auth,

'X-CSRF-Token': 'Fetch'

},

success: function (res, status, xhr) {

sc.localData.csrf = xhr.headers['x-csrf-token'];

ctx.log(sc.localData.csrf);

ctx.log(status);

ctx.ajax.call( {

url: 'https://sapfhdaasd001.u****************:44301/sap/opu/odata/sap/ZM****************A_SRV/Val*****ad*et',

async: false,

usePassport: true,

ignoreClientCertificate:true,

method: e.ajax.method.post,

contentType: e.ajax.content.json,

data:JSON.stringify(payload),

headers: {

'Authorization': "Basic " + auth,

'x-csrf-token' : sc.localData.csrf

},

success: function (res, status, xhr) {

ctx.log("Second Success Block");

ctx.log(status);

ctx.log(res);

sc.endStep(); // Loops_to_the_Start_bl

return ;

},

error: function (xhr, status, statusText) {

var errorMessage = xhr.status + ': ' + xhr.statusText + ': ' + xhr.responseText;

ctx.log("data failed:" + errorMessage);

ctx.log(JSON.stringify(xhr.status));

sc.endStep(); // Loops_to_the_Start_bl

return ;

}

});

},

error: function (xhr, status, statusText) {

var errorMessage = xhr.status + ': ' + xhr.statusText + ': ' + xhr.responseText;

ctx.log("End Error Block:" + errorMessage);

ctx.log(JSON.stringify(xhr.status));

sc.endStep(); // Loops_to_the_Start_bl

return ;

}

});

}

Any help here is appreciated.



Thanks in Advance,
Sri Mounika

[SampathRamanuja]

Surprisingly this is giving me big trouble as of today we are in Sep 2024 and core sdk 1.56 . When I debug everything the new session I'd created with fetch so new session and post giving csrf validation failed. Please suggest what's solution.

[amit_sharma96]

Hello @Mounika,

When you use ignoreClientCertificate:true in ctx.ajax call , the SDK uses a C++ implementation to do the API call. Where while doing the POST call with csrf token, cookies also need to be added in the request header which was obtained from the previous GET call.

cookies can be retreived similar to CSRF token like :
var value = xhr.headers["Set-Cookie"]; //cookie retrival from GET call

headers["Cookie"] = formatCookies(value); //Setting cookie in request header for POST call

Kindly check this WIKI links for more details regarding how to format cookies.
To know more about ignoreClientCertificate flag, please check my blog and let me know your feedback.
Hope this helps 🙂

[srimounika_kadiyala]

Hi Amit,

Thanks for the response.

We are unable to open this WIKI links if possible could you please share the information.

And also in the headers we tried fetching both the Cookie and CSRF token when we try to fetch cookies CSRF token is not generating and if we try for fetching CSRF token then Cookie value is showing undefined. We are unable to fetch both at a time.

Any help on this issue is highly appreciated.

Thanks,
Sri Mounika

[TJe]

Guess you have the same issue, we have found when using the SAP Analytics Cloud API.
In the current version, IRPA is not able to handle this cause the requests are executed not in the same request session.
This is planned to be possible with version 2103.
You can find some more information in my blog: Use SAP Analytics Cloud REST API with SAP Intelligent RPA – Automations

hope this helps, regards
Thomas

[TJe]

My experience is based on custom script in IRPA SDK 2.0, but guess it is the same on SDK 1.0.
Here is a hint how you can test if this is your issue:
- execute the GET request to retrieve the CSRF token, check the returned token value
- execute the GET request to retrieve the CSRF token again, check the returned token value
if the values are different, this is an indicator, that the request are not using the same request session.
POSTMAN for example is using one request session, this is why it worked for me in Postman also.

[srimounika_kadiyala]

Hi Thomas,

Thanks for the response.

I have checked the GET token value as you mentioned I got two different GET tokens. So, can you help with the solution how can we fix that request to get the token from same session? Else is it possible to implement CURL code in IRPA?


Thanks,
Sri Mounika

[TJe]

Guess you have to wait till release 2103 is available (as far as I know this should be mid March) or look into the solution mentioned by Amit below.
The release 2103 will have a new feature which uses the module 'rough-cookie'.

[TJe]

Release 2103 is available now, I have just tested on my trial and it is working now.
Important that you update the IRPA core SDK package to the latest version.

regards
Thomas