How long CSRF token valid time is?

[ArcherZhang]

Hi experts,

When test a update or a create operation of OData service, CSRF token needed, right.

So i wanna know how long one token valid for, 3 mins or 5 mins? or some setting at some where?

Regards,
Archer

[Private_Member_15166 · Accepted solution]

Hi,

Check out this link.

Cross-Site Request Forgery Protection - SAP Gateway Foundation (SAP_GWFND) - SAP Library

It remains valid for 24 hours.

Here you may find it out.

1. Release < 7.03/7.31 or the security session management is inactive: An own CSRF cookie gets generated (sap-XSRF_<SystemID>_<SAPClient>) and this CSRF token remains valid for 24 hours (86400 seconds).
2. Release >= 7.03/7.31, the validity is bound to the security session, which depends on the system parameter http/security_session_timeout value (see transaction RZ11 for details on this parameter). By default, the security session management is active in these releases.

CSRF Protection - Connectivity - SAP Library

[ArcherZhang · Accepted solution]

I did not got answer from Google, so ask this simple question here. Thank you, Dhananjay.

regards,

Archer

[Private_Member_15166 · Accepted solution]

Welcome.