CSRF token problem in firefox

[Former Member]

Hi,

When I post something to the server using GW, I get statuscode 403. This only happens when I use firefox, in Chrome and IE everything works fine.

The crsf token is fetched succesfully, but for some reason, it is undefined in my POST request (when using firefox).

Anyone who can help me?

Kind regards,

RW

[Former Member · Accepted solution]

Anyone?

[Former Member · Accepted solution]

Hi Robbe,

you should probably change yourdefault CSRF protection mechanism in SICF.

Refer the the link below for more information:

Cross-Site Request Forgery Protection - SAP NetWeaver Gateway - SAP Library

Regards,

Ashvin

[Former Member · Accepted solution]

Thanks for the reply, but I don't see why the x-csrf token is undefined in some browsers/devices...

[Former Member · Accepted solution]

Robbe,

are you using odatamodel for creating new entries? Could you send code snippet where you try to fetch token & post data ?

Regards,

Peter

[Former Member · Accepted solution]

Hi Peter,

The code snippet is attached.

I really don't get it, there is even a difference between using iPad mini and iPad 4, using the same version of google chrome...

Anyways, thanks for taking a look at my problem!

RW

codeSnippet.txt.zip

[Former Member · Accepted solution]

I also have the feeling in some browsers the success function is executed before the call to fetch the csrf token is finished. So this might be a sync/async issue?

[Former Member · Accepted solution]

Robbe,

that could be, or it could be something wrong with odata.request.

You can try to rewrite your post operation into odatamodel.create(). It is smooth and you are fully using what odatamodel gives you. You have even set tokenHandling in your example, but if you are not using odatamodel operations, it does not have any effect. You can check my blog - 1st and 2nd issue for more info.

This is example how I implemented post operation. When you are using odatamodel.create() you do not need to take care about the token by yourself:

   // setting up model

   var oModel = new sap.ui.model.odata.ODataModel("link_to_your_odata_service", false);

   sap.ui.getCore().setModel(oModel);

   var oEntry = {};

   oEntry.Email = content[2].getValue();

   oEntry.Firstname = content[4].getValue();

   oEntry.Lastname = content[6].getValue();

   oEntry.Age = content[8].getValue();

   oEntry.Address = content[10].getValue();

   sap.ui.getCore().getModel().create('/UserSet', oEntry, null, function(){

   oCreateDialog.close();

   sap.ui.getCore().getModel().refresh();

   },function(){

   oCreateDialog.close();

   alert("Create failed");

   }

   );

See full snippet here Sample ui5 app that consumes oData service

I am not sure if that helps you, but I guess it is worth trying.

Regards,

Peter

[Former Member · Accepted solution]

Hi Peter,

I just changed my code, and now it also works in Firefox.

On the iPad 4 it still doesn't work, but now I get another error:

network_err: xmlhttpRequest exception 101

I already tried to refresh the sucurity token before the create() function, both sync and asycn. But I get the same result.

Kind regards,

RW

[Former Member · Accepted solution]

Robbe,

I do not have any info about that, maybe this can help.

Regards,

Peter