Hi,
In SAP Build Apps, how do I pass a CSRF token in the HTTP header of a CREATE record flow function?
To GET the CSRF token, I added a HTTP request flow function and stored the CSRF token returned by the response in an app variable.
How do I pass the app variable to the next CREATE record flow function?
When I added my data resource, I see the option called 'Common request header', where I added the header parameter name. But, I don't see an option to bind the variable.
I haven't tried it, but I think this will probably work:
Add the CSRFToken as an HTTP header in the REST Api configuration. Set the Label and Key to "CSRFToken", set Value type to "Text", set Is static to off or false, and Is optional to on or true. That should then add the CSRFToken to the inputs on the Create record flow function. Making the header "Not static" makes it available for a formula or variable binding in the flow function configuration.
Here's what that looks like for a get record collection call that I modified:
Hello @JoeBinkley ,
Thank you for the response! I am using the Odata integration to call my API.
I set my base URL here and we do not have an option to add HTTP header here unlike REST API integration. However, I see 'Common request header' option. If click this and try to make a list of values, I don't see an option to bind my CSRFToken variable. Not sure if this is the right way!
Does the approach differ for OData integration?
I don't have an easy way to test this, but I think this will work. You can use a formula that references an additional input.
First, add the additional input:
Then add the list item to the common request headers. (You can do the value with the formula editor)
In the logic flow, you should see this sort of property sheet:
Note, by the way, the warning below about CORS that is shown when you test the data source. I was testing whether the addition of the token would break the OData call using Web Preview and got an error message. But it did work using the Preview App on iOS.
- Web preview: will not work
- Web standalone deployment: might not work, depending on the exact CORS restrictions and the URL from which the app is accessed
- iOS/Android/macOS preview: will work
- iOS/Android/macOS standalone app: will work
Yes, that is the API I am using.
No, haven't set up the BTP destination. If we set up a BTP destination, in the build apps, do we use 'SAP BTP destination REST API integration' instead of OData integration to perform the POST operation with the API?
@JoeBinkley : Thanks for the inputs! I have been able to get this working.
The approach was same, use HTTP flow function to get the CSRF token. Additionally, pass the X-CSRF-TOKEN ~ FETCH in the header. Store the CSRF token in a variable. Then, use the 'Create record' flow function and pass the CSRF token here. To pass the CSRF token to a OData data resource, need to add an additional new input (approach is the same as in your reply).
The only difference for this API was, I created a data record and passed it.
Earlier, I was passing the field level inputs at the record level and there was a failure. Not sure if it is needed this way for this specific API. But, this is my logic in the canvas now:
Btw, the BTP destination feature works really well too and it did not involve the hassle and fetching and passing CSRF token. But, the mobile preview doesn't work and we have features like scanning a barcode on our app and those do not work in web preview. So, we have planned to stick with this workaround for now.
Thanks for the support 🙂 !
