CSRF Tokens

Overview

A CSRF (Cross Site Request Forgery) Token is a secret, unique and unpredictable value a server-side application generates in order to protect CSRF vulnerable resources. The tokens are generated and submitted by the server-side application in a subsequent HTTP request made by the client.

In the manifest

Card developers describe the CSRF Tokens in the configuration section, csrfTokens subsection of the manifest. These tokens can be referred inside a data request using a placeholder like {{CSRFTokens.myCSRFToken}}. See the example below.

CSRF Token properties:

Property Type Required Description Schema Version Since
data Data Yes The data section 1.38.0 1.97

In the host environment

The CSRF Tokens can be resolved by the host application developer. For detailed information about the contribution from host environment, see Integrate CSRF Tokens.

Example

An example with a card which fetches data and uses CSRF Tokens:

"sap.card": {
	"type": "List",
	"configuration": {
		"destinations": {
			"ProductsMockServerWithCSRF": {
				"name": "ProductsMockServerWithCSRF",
				"label": "Products Mock CSRF",
				"defaultUrl": "/getDataWithCSRF"
			}
		},
		"csrfTokens": {
			"token1": {
				"data": {
					"request": {
						"url": "{{destinations.ProductsMockServerWithCSRF}}/Token",
						"method": "HEAD",
						"headers": {
							"X-CSRF-Token": "Fetch"
						}
					}
				}
			}
		}
	},
	"data": {
		"request": {
			"url": "{{destinations.ProductsMockServerWithCSRF}}/Products",
			"parameters": {
				"$format": "json"
			},
			"method": "GET",
			"headers": {
				"X-CSRF-Token": "{{csrfTokens.token1}}"
			}
		},
		"path": "/data"
	},
	"header": {
		"title": "Products",
		"subTitle": "Weight Information",
		"icon": {
			"src": "sap-icon://product"
		}
	},
	"content": {
		"item": {
			"title": "{Name}",
			"info": {
				"value": "{= format.unit(${Weight}, ${WeightUnit})}"
			}
		},
		"maxItems": 4
	}
}
Try it Out