topic Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized. in Integration, Extension & APIs

Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized.

tevkar1 — Wed, 21 Feb 2024 14:36:39 GMT

Hi,

We have a weird situation. When we call QRS API at our test environment (..../qrs/about), we get the following error message:

XSRF prevention check failed. Possible XSRF discovered.

Production environment works well. We use same Qlik edition - August 2023 patch 5

Restarting services doesn't help.

Appending "?xrfkey=16-char-string" doesn't help.

Any pointers ? where to look ?

Kind regards

Re: Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized.

Levi_Turner — Wed, 21 Feb 2024 19:43:07 GMT

The most likely culprit is a mismatch or absence of the xrfkey parameter and/or header (reference). To use the example from the help doc:

URL: https://localhost:4242/qrs/servernodeconfiguration/full?Xrfkey=abcdefghijklmnop
Header: X-Qlik-Xrfkey: abcdefghijklmnop

If you do not have the same Xrfkey specified in the URL param (?Xrfkey=abcdefghijklmnop) as in the X-Qlik-Xrfkey header, you will receive this response.

Re: Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized.

Tool_Tip — Wed, 03 Sep 2025 07:22:31 GMT

How should I pass Header with URL ?

Re: Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized.

Øystein_Kolsrud — Wed, 03 Sep 2025 07:29:09 GMT

How you specify headers depends totally on what technology you use for calling the APIs. Is it through a browser? Or Postman? Or programmatically through some programming language?