SAP OData Service - X-CSRF-Token validation failed from client app
<p>Anyone here have good knowledge of X-CSRF-Token behaviour on SAP OData services, in particular when used with Windows Auth (Kerberos) authentication?</p>

<p>Am developing against GET/PUT services which behave fine in testing via Postman; X-CSRF-Token retrieval happens just before a PUT call, and the PUT call is accepted when the token is submitted back (along with cookies from the SAP Portal session).</p>

<p>Test service is on HTTPS on URL such as:
<a href="https://sapqe0.clientname.com.au:44380/sap/opu/odata/SAP/Z_SERVICE_NAME_SRV/TestService" rel="nofollow noreferrer">https://sapqe0.clientname.com.au:44380/sap/opu/odata/SAP/Z_SERVICE_NAME_SRV/TestService</a>('parameter')</p>

<p>When trying from a .NET client app, GET calls work fine including token retrieval, but the PUT returns a 403 'CSRF Token Validation Failed' error, despite seemingly valid token passed.</p>

<p>Have traced through with Fiddler, and the request/response packets look identical to those sent by Postman. Only difference I see is the client app receives a different token on every request, while Postman receives the same token on successive calls. May imply that session isn't recognized properly from the app?</p>

<p>The C# app is using the Windows identity (DefaultCredentials) and first hits the SAP Portal to get cookies and attach to OData requests.</p>

<p>Any clues on what would cause a CSRF token validation failure in this scenario?</p>