SAP Netweaver Gateway 7.4 Cross-Site Request Forgery protection

[mikejackson]

We are currently developing new services using SAP Netweaver Gateway 7.4 and have come accross the Cross-Site Request Forgery protection mechanism.

I've got a couple of simple questions regarding this :-

(a) Can we disable the need for it ?

(b) If we were to use a get service to retrieve a token how long does the token last for ?

Any help appreciated.

Mike

[AshwinDutt]

Hello Mike,

You can disable as shown below ->

Cross-Site Request Forgery Protection - SAP NetWeaver Gateway Foundation (SAP_GWFND) - SAP Library

But Please note that for all modifying requests, the service must include this token in an HTTP request header field X-CSRF-Token considering the security measures.

Regards,

Ashwin

[Jitendra_Kansal]

Mike,

Your both queries are answered in this blog. Read the complete blog and comments:

[mikejackson]

Jitendra,

Many thanks for the link and it was useful because it answered one of the questiosn I had but not the other (that I could see anyway).

We are currently developing a android app that is making use of OData Services provided by the Gateway. The app will be managed by Airwatch and only used by a small number of internal users. For this reason I was trying to avoid the need for them to use the CSRF functionality. Is there any way it can be disabled so it does not have to be used ?