403 on onPremise connector with CSRF + Cookie

SAP / cloud-sdk-js

Use the SAP Cloud SDK for JavaScript / TypeScript to reduce development effort when building applications on SAP Business Technology Platform that communicate with SAP solutions and services such as SAP S/4HANA Cloud, SAP SuccessFactors, and many others.

Apache License 2.0

167 stars 57 forks source link

403 on onPremise connector with CSRF + Cookie #665

Closed ghiblin closed 4 years ago

ghiblin commented 4 years ago

We are facing issues using the cloud sdk to access a OData service through the cloud connector. The issues we are facing regards the creation of a new entity through an OData v2 request. As documented, odata v2 client should handle the CSRF token, but I get a 403 unauthorized response. If I use axios to handle the whole process, the only way to success it's to fetch the csrf with an HEAD call with X-CSRF-Token=Fetch header and then to pass back the csrf token from the server and the cookies the server is sending back with a set-cookie header on the response. I'm speculating that the odata client doesn't set the cookies.

@sap-cloud-sdk/core@1.30.0

artemkovalyov commented 4 years ago

Hi @ghiblin,

Thanks for bringing this up and investigating with Axios till success. From what I know cookies are required. @FrankEssenberger, do you know if we set cookies or only rely on headers?

@ghiblin, can you share what system are you running against? S4, Success Factors, C4C, or smth else? There could be peculiarities related to that. Also, do you use a pre-generated client library, or have generated your own?

Best, Artem

jjtang1985 commented 4 years ago

Hi @ghiblin , thank you for raising this up. I think we have a similar open issue: https://github.com/SAP/cloud-sdk/issues/617, where the user faced some csrf issues when calling the On-Premise system.

In order to understand your issue better, could you please provide you code snippets and the whole stack trace if possible?

ghiblin commented 4 years ago

Hi @jjtang1985 I've just tried again and now it looks like it's working. I'm going to close these issue.

thank you