Update,Create and Delete with ODATA service result in 403 Forbidden Error

[Former Member]

Hi,

I have a Hana XS Engine with an odata service. The service allows me to read the data of my tables. As soon as I want to Create, Update or Delete an entry I get the 403 - Forbidden error Page returned.

My user actually has the required rights to execute one of these actions (it works in Hana Studio with the sql command line), but I additionally tested it with the system user and got the same result.

Is this a known issue or is there a solution to my problem?

Thank you in advance!

[thamizharasan]

Hi Yannick,

Even i'm facing the same issue. I have updated my xsaccess file too.

{
    "exposed": true,
    "authentication": [{
        "method": "Basic"
    }],
    "default_file": "index.html",
      "cors" : { "enabled" : true, "allowMethod":["GET","POST","HEAD","DELETE","OPTIONS"]}  
}

Could you please explain how you resolved the issue..?

Regards,

ThamizharasaN.

[Former Member]

Hello Thamizharasan,

Did you solve it?

If yes, please give me some advice to solve this.

Thanks.

[thamizharasan]

Hi Frankie,

Yes the problem is solved. First check whether you have the needed privileges. Then we need to do one more thing to make it work. Just navigate to /sap/hana/xs/admin/ in your system, select your application and check whether the update, create and delete are there in allowed methods. After this everything went fine for me.

Regards,

ThamizharasaN.

[former_member198968]

hi ThamizharasaN,

I have done this. And i am able to post data successfully using xsjs service but not from XSOdata service. Is there anything i may be missing.?

thanks in advance,

regards,

Animesh Ghosh

[thamizharasan]

Hi Animesh,

Let me know what error you are getting when you with xsodata..?

Regards,

ThamizharasaN.

[Former Member]

Hi Animesh,

if you are getting 403 - Forbidden error try modifying your xsaccess file like this:

{
     "exposed" : true, 



     "cache_control" : "must-revalidate",


     "cors":
      {
      "enabled":true,
      "allowMethods": ["GET","POST","DELETE","PUT"],
      "allowOrigin": ["*"],
      "maxAge":"3600"
      },


     "enable_etags" : false,


     "force_ssl" : false,

     "prevent_xsrf" : false
}

especially the cors part solved the issue for me.

Best regards,

Yannick

[former_member210023]

Hi ThamizharasaN,

                           Could you please let me know the detailed path for updating CORS. I am unable to find it in HCP.

Thanks

Arka

[thamizharasan]

Hi Arkajeet,

Just go to the admin console in HCP

https://<<you hcp system url>/sap/hana/xs/admin/

There you can find your application under xs artifact administration application objects.

Regards,

ThamizharasaN.

[former_member210023]

Thanks ThamizharasaN. I believe I do not have authorization as I am getting a 403. I shall take it up with the concerned people.

Thanks

Arka

[Former Member]

I got it to work now. My mistake was that I only allowed the GET method (in the xsaccess).

[Former Member]

Hi Yannick,

How did you correct this ?

-Avinash

[Former Member]

This message was moderated.

[thomas_jung]

I suggest you activate trace for this service and see what is being logged. It will show you the user running the request and generated SQL. Perhaps you have a technical user running this service. You also haven't posted your XSODATA definition. Are the entities directly against tables or views?  Create/Update/Delete against views only work with implemented exits otherwise they return forbidden.