OData "GET" method doesn't return CSRF Token - issue with $batch GET

[former_member190939]

Hello,

When I am doing OData.request - Get method, the data is returned perfect but the response header has "x-csrf-token" undefined. What may be the reason? Since the data is returned properly, there is no issue here.

But when I do batch "GET" operation, it fails saying that The following problem occurred: HTTP request failed403,Forbidden,CSRF token validation failed - 

And my code related to batch "GET" looks like below:

var batchChanges = [];  

  var serviceUrl = "http://111:8000/sap/opu/odata/sap/ZUI5_MAIN_SRV/";

  oModel = new sap.ui.model.odata.ODataModel(serviceUrl, true);

  batchChanges.push( oModel.createBatchOperation(

  "/salesColl_saveInvoicesSet?$filter=abc+eq+'2'+"'",

  "GET") );

  if(batchChanges.length == 0)

  sap.ui.commons.MessageBox.alert("No data to submit");

  else{

     oModel.addBatchReadOperations(batchChanges); 

     oModel.setUseBatch(true);

     oModel.submitBatch(function(data, response) {  

         oModel.refresh();  

//        if (data.__batchResponses[0].__changeResponses) {

//            alert("Inserted " + data.__batchResponses[0].__changeResponses.length + " Employee(s)");  

//        } else {

          var outLength = data.__batchResponses.length;

          var outMessage = "";

          if(outLength > 0){

          outMessage = "Transaction Saved";

          sap.ui.commons.MessageBox.alert(outMessage);

          }

             //alert(data.__batchResponses[0].message);  

//        }

     }, function(err) {  

       alert("Error occurred", err);  

     });  

  }

But the strange thing here is that in the error function call of above code, I can see the method triggered is "POST" even though I use "GET" in the batch call. Please advise where am I going wrong? Please note that I am receving csrf tokens in the rest - postman client also.

Thank you so much,
Seyed Ismail

[EkanshCapgemini · Accepted solution]

Dear Seyed,

$batch calls are always POST calls irrespective of included calls in the batch request body. Thus $batch calls require to pass X-CSRF-Token by default.

For CSRF Token issue, I have replied on your other thread on similar topic.

Regards,

Ekansh

[former_member190939 · Accepted solution]

Yes, It is resolved. Thanks for the explanation.

Seyed Ismail.