Fiori 403 errors · Fiori 403 Root-Cause Doctor
CSRF token missing or invalid on modifying request
- Default severity
- Critical
- Finding code:
- FIORI_CSRF_TOKEN_INVALID
- Engine version:
- 2.2.0
What this finding means
Fiori 403 Root-Cause Doctor reports this finding with the default severity “Critical”.
About the engine: PFCG role, auth objects (S_START, S_SERVICE) & ICF catalog auditor
How to fix it
Fetch a token with 'X-CSRF-Token: Fetch' on a GET/HEAD, then send the token and session cookies with the POST/PUT/PATCH/DELETE; check that proxies / Web Dispatcher keep the session cookie.
How ERP Preflight detects it
The analysis is deterministic: the same exported files and the same knowledge snapshot always produce the same findings. No SAP system connection is required — you upload exports.
- Engine
- Fiori 403 Root-Cause Doctor
- Accepted formats
- JSON, CSV, TEXT
- What to export
403 diagnostic telemetry: JSON {'http_response': {status_code, method, url, headers, body}, 'su53': [...], 'iwfnd_error_log': [...], 'icf_services': [...], 'ucon_rules': [...], 'cloud_connector_logs': [...], 'btp_destination': {name, url, proxy_type, authentication, check_status}}, a browser network export (HAR JSON {'log': {'entries': [...]}}), an HTTP request/response text dump or SU53 text export, or SICF/SU53 CSV artifacts.
- Required input
- At least one telemetry source (HTTP trace or HAR, SU53, /IWFND/ERROR_LOG, SICF, UCON, BTP destination, Cloud Connector)
- Evidence
- Each finding points to the artifact path, line and column, the code snippet and the SHA-256 of the uploaded file. Findings without such a pointer are demoted to confidence UNKNOWN.
- Confidence
- The verdict rests on your artifacts only. Each finding carries a confidence class (VERIFIED, RULE_DERIVED, INFERRED or UNKNOWN) that shows how strong the evidence is.
- Target releases of the engine
- S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Related findings
- BlockerICF service node inactive (SICF)
- CriticalAuthorization check failed (SU53)
- CriticalBTP destination rejected by or not authenticating to the backend
- CriticalDenied by SAP Cloud Connector
- CriticalGateway service not registered / no system alias
- CriticalBlocked by UCON / RFC allowlist
Terms used on this page
Background reading
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.