topic Integration JWT error with Qlik Saas in Integration, Extension & APIs

Integration JWT error with Qlik Saas

juanpcardenas — Fri, 06 Jan 2023 22:43:01 GMT

Hi Everyone, I am trying to integrate my external users with the JWT in Qlik SaaS. we are getting the error below

Access to XMLhttpRequest at https://tenant/login/jwt-session?qlik-web-integration-id=xxxx from origin Our https website has been blocked by CORS policy: Request header field x-csrf-token is not allowed by Access-Control-Allow-Headers in preflight response.

Post https://tenant/login/jwt-session?qlik-web-integration-id=xxxx net: ERR_FAILED

Anybody had had the same error before. Any suggestionxs.

Thanks

Re: Integration JWT error with Qlik Saas

Aiham_Azmeh — Mon, 09 Jan 2023 09:26:21 GMT

Hi @juanpcardenas ,

Just remove it, this endpoint doesn't seem to need the csrf-token. ex:

await fetch( https://your-tenant/login/jwt-session`, { method: 'POST', credentials: 'include', mode: 'cors', headers: { 'content-type': 'application/json', Authorization: `Bearer ${signedToken}`, 'qlik-web-integration-id': <your-web-int-id>, }, }, )

I recommend you use our official platform TS SDK, it has function helpers for the JWTAuth flow

https://www.npmjs.com/package/@qlik/sdk#jwt-auth

https://qlik.dev/libraries-and-tools/platform-sdk

https://paka.dev/npm/@qlik/sdk@0.16.0/api

Re: Integration JWT error with Qlik Saas

juanpcardenas — Tue, 10 Jan 2023 15:01:39 GMT

Hi Aiham, Thanks for you answer.

Looks like for security purposes is not possible to remove it, Check this link below

https://stackoverflow.com/questions/52506243/angularjs-remove-x-csrf-token-in-http-get

We are using Angular JS for this JWT token.

Any other idea how to handle it? Web developers are assuming Qlik Cloud is denying it.

Re: Integration JWT error with Qlik Saas

juanpcardenas — Tue, 10 Jan 2023 15:03:47 GMT

Aiham, Do you have any suggestion to remove it from Angular JS

Re: Integration JWT error with Qlik Saas

Aiham_Azmeh — Wed, 11 Jan 2023 06:45:13 GMT

Reading their docs, it seems like it should be possible through the transformRequest prop (overriding the default headers) docs

The alternative would be to use the browser fetch API instead.

I hope this helps

Re: Integration JWT error with Qlik Saas

juanpcardenas — Fri, 13 Jan 2023 20:52:30 GMT

Thanks the Angular team checked the documentation and looks like now we are not getting that error.