Integration JWT error with Qlik Saas

[juanpcardenas]

Hi Everyone, I am trying to integrate my external users with the JWT in Qlik SaaS. we are getting the error below

Access to XMLhttpRequest at https://tenant/login/jwt-session?qlik-web-integration-id=xxxx from origin Our https website has been blocked by CORS policy: Request header field x-csrf-token is not allowed by Access-Control-Allow-Headers in preflight response.

Post https://tenant/login/jwt-session?qlik-web-integration-id=xxxx net: ERR_FAILED

Anybody had had the same error before. Any suggestionxs.

Thanks

[Aiham_Azmeh]

Hi @juanpcardenas ,

Just remove it, this endpoint doesn't seem to need the csrf-token. ex:

await fetch(
      https://your-tenant/login/jwt-session`,
      {
        method: 'POST',
        credentials: 'include',
        mode: 'cors',
        headers: {
          'content-type': 'application/json',
          Authorization: `Bearer ${signedToken}`,
          'qlik-web-integration-id': <your-web-int-id>,
        },
      },
    )

I recommend you use our official platform TS SDK, it has function helpers for the JWTAuth flow

https://www.npmjs.com/package/@qlik/sdk#jwt-auth

https://qlik.dev/libraries-and-tools/platform-sdk

https://paka.dev/npm/@qlik/sdk@0.16.0/api

[juanpcardenas]

Hi Aiham, Thanks for you answer.

Looks like for security purposes is not possible to remove it, Check this link below

https://stackoverflow.com/questions/52506243/angularjs-remove-x-csrf-token-in-http-get

We are using Angular JS for this JWT token. 

Any other idea how to handle it? Web developers are assuming Qlik Cloud is denying it.

[juanpcardenas]

Aiham, Do you have any suggestion to remove it from Angular JS

[Aiham_Azmeh · Accepted solution]

Reading their docs, it seems like it should be possible through the transformRequest prop (overriding the default headers) docs

The alternative would be to use the browser fetch API instead.

I hope this helps

[juanpcardenas]

Thanks the Angular team checked the documentation and looks like now we are not getting that error.