Message "XSRF prevention check failed. Possible XSRF discovered." appears when QRS API is utilized.

[tevkar1]

Hi,

We have a weird situation. When we call QRS API at our test environment (..../qrs/about), we get the following error message:

XSRF prevention check failed. Possible XSRF discovered.

Production environment works well. We use same Qlik edition - August 2023 patch 5

Restarting services doesn't help.

Appending "?xrfkey=16-char-string" doesn't help.

Any pointers ? where to look ?

Kind regards

[Levi_Turner · Accepted solution]

The most likely culprit is a mismatch or absence of the xrfkey parameter and/or header (reference). To use the example from the help doc:

URL: https://localhost:4242/qrs/servernodeconfiguration/full?Xrfkey=abcdefghijklmnop
Header: X-Qlik-Xrfkey: abcdefghijklmnop

If you do not have the same Xrfkey specified in the URL param (?Xrfkey=abcdefghijklmnop) as in the X-Qlik-Xrfkey header, you will receive this response.

[Tool_Tip]

How should I pass Header with URL ?

[Øystein_Kolsrud]

How you specify headers depends totally on what technology you use for calling the APIs. Is it through a browser? Or Postman? Or programmatically through some programming language?