CPI: How to send all cookies to the server

[siwei_yang]

Dear SAP Experts,

recently we got an e-mail from SAP. Maybe some of you got it too. It says, that due to some kind of optimization we will have to send all cookies to the server in case of consuming an ODATA API.

Actually in CPI we have an integration-flow which invokes an ODATA Service from side of C4C.

This integration flow looks like the following screenshot :

so my first question: Is this email really relevant to our case ?

The second question is how to send all cookies to C4C within the given integration flow, if this email is relevant to our case?

It would very nice, if you have any idea,

Best regards

Peter

[Sriprasadsbhat]

Hello Peter,

Could you please check KBA that's mentioned in your email received from SAP. On high level there is a change that's been made at OData API level. From cloud integration perspective you can check once if you have enabled CSRF Protected or not if yes please perform regression testing once and I don't think there will be issue while calling these APIs from Cloud integration OData adapter since its handled internally.

You might need to consider above change if you are calling thee OData api from other middleware or application where you are explicitly handling token exchange and setting cookies.

Below might help you to understand more CSRF protection from Cloud Integration OData adapter perspective.

https://blogs.sap.com/2019/08/28/best-practice-for-using-csrf-protected-flag-in-cpi-odata-adapter-ou...

Regards,

Sriprasad Shivaram Bhat

[siwei_yang]

Hello Sriprasad,

thank you for your reply.

Actually I did read that KBA. But it doesn't give me any clue to understand the issue. That is the reason why I had to consult sap community here.

In our case we use SAP CPI to create the integration flow without enabling the option "CSRF Protected" as shown in screenshot. So do you mean, that we don't need to consider this thing, since it is handled internally?

Best wishes

Peter