3710344 - X-Requested-With Header Is Mandatory but Its Value Is Arbitrary When CSRF Protection Is Disabled

When CSRF token protection is disabled for custom OData V2 services, observe that:

• The HTTP header X-Requested-With is mandatory

• Requests fail if the header is missing

• However, the value of the header appears to be arbitrary

  • Examples such as "x", "test", "abc" all work

• SAP S/4HANA
• SAP Gateway

csrf token, odata v2 services, x-requested-with header, arbitrary header value, middleware, sap note 2751277, sap s/4hana, custom odata services, header validation, disable csrf protection, sap business partner module. , KBA , OPU-GW-COR , Framework , Problem