CSRF Tokens
Overview
A CSRF (Cross Site Request Forgery) Token is a secret, unique and unpredictable value a server-side application generates in order to protect CSRF vulnerable resources. The tokens are generated and submitted by the server-side application in a subsequent HTTP request made by the client.
In the manifest
Card developers describe the CSRF Tokens in the configuration
section,
csrfTokens
subsection of the manifest.
These tokens can be referred inside a data request using a placeholder like
{{CSRFTokens.myCSRFToken}}
. See the example below.
CSRF Token properties:
Property | Type | Required | Description | Schema Version | Since |
---|---|---|---|---|---|
data | Data | Yes | The data section | 1.38.0 | 1.97 |
In the host environment
The CSRF Tokens can be resolved by the host application developer. For detailed information about the contribution from host environment, see Integrate CSRF Tokens.
Example
An example with a card which fetches data and uses CSRF Tokens:
"sap.card": { "type": "List", "configuration": { "destinations": { "ProductsMockServerWithCSRF": { "name": "ProductsMockServerWithCSRF", "label": "Products Mock CSRF", "defaultUrl": "/getDataWithCSRF" } }, "csrfTokens": { "token1": { "data": { "request": { "url": "{{destinations.ProductsMockServerWithCSRF}}/Token", "method": "HEAD", "headers": { "X-CSRF-Token": "Fetch" } } } } } }, "data": { "request": { "url": "{{destinations.ProductsMockServerWithCSRF}}/Products", "parameters": { "$format": "json" }, "method": "GET", "headers": { "X-CSRF-Token": "{{csrfTokens.token1}}" } }, "path": "/data" }, "header": { "title": "Products", "subTitle": "Weight Information", "icon": { "src": "sap-icon://product" } }, "content": { "item": { "title": "{Name}", "info": { "value": "{= format.unit(${Weight}, ${WeightUnit})}" } }, "maxItems": 4 } }Try it Out