Getting 403 when attempting to access LDX incoming-links
I am attempting to POST https://jazz.net/sandbox02-ldx/ldx/incoming-links and getting error 403 with the following message:
CRLQE0629E The user has the roles required to perform this operation, but the permission has been denied because this request might have been forged by a malicous website. To prove that this request is not part of a CSRF attack add a new HTTP header with the name 'X-Jazz-CSRF-Prevent.
I have provided the X-Jazz-CSRF-Prevent header with the JSESSIONID and that made no difference. There were two JSESSIONID headers in a successful GET request to LDX, I tried them both, same result. One of these JSESSIONIDs was JSESSIONID00007476E30E27BCCA3082A2B86019A4:28e05f04-2609-42a5-b77e-d6fea32ebe5e. Is this the correct value to use? Does the : need to be escaped with %3A? The other JSESSIONID was DCCB7476E30E27BCCA3082A2B86019A4, this didn't work either.
What am I missing?
3 answers
Hi Jim,
from the response when you are authenticating, get the cookie value for the cookie JSESSIONID. Pass the value unmodified as value for the header X-Jazz-CSRF-Prevent. You do not have to url encode the value.
I recently noticed that this is sometimes not enough. I noticed using different REST extensions, that requests did not get through, where they should. I found that the value of the header User-Agent influenced the POST call being accepted or not. If I set User-Agent to an arbitrary value, other than the browser default, the request succeeded.
I recently noticed that this is sometimes not enough. I noticed using different REST extensions, that requests did not get through, where they should. I found that the value of the header User-Agent influenced the POST call being accepted or not. If I set User-Agent to an arbitrary value, other than the browser default, the request succeeded.
I made some progress. Setting header X-Jazz-CSRF-Prevent=1 seemed to get past the 403 Forbidden error. Is it possible that for LQE/LDX this is now a boolean parameter?
Accept=application/json
Configuration-Context=
X-Jazz-CSRF-Prevent=1
Content-Type=x-www-form-urlencoded
oslc_config.context=https://jazz.net/sandbox02-gc/configuration/400
limit=10
Now gives 404 instead of 403 which might indicate LDX incoming-links isn't enabled for 7.2?
So I assumed that perhaps LQE is handling incoming links in 7.2 and tried:
Accept=application/json
Configuration-Context=
X-Jazz-CSRF-Prevent=1
Content-Type=x-www-form-urlencoded
oslc_config.context=https://jazz.net/sandbox02-gc/configuration/400
limit=10
which now gives 401 Unauthorized (not 403 Forbidden) which would indicate that I need to use the functional ID to access, which I probably can't do on jazz.net. I probably need to setup a local server to do this. MID's ELM installation is still 7.0.2.