Disabling the CSRF Token When Connecting From a Release 8.0.x Client

The Version 7 Release 7.06 server supports a CSRF Token. This token is sent with each POST request in order to prevent a Cross-Site Request Forgery attack. If you are using a Release 8.0.x WebFOCUS client that is supported with the 7.7.06/8.1.x server, you need to disable the CSRF token in order to successfully connect to the server's HTTP Listener. You can disable the token from the server Workspace page.

  1. Open the Special Services and Listeners folder.
  2. Right-click TCP/HTTP, and select Properties of HTTP from the context menu.

    The Listener Configuration page opens.

  3. Open the security section of the page, and select zero (0) from the CSRF_TOKEN drop-down list, as shown in the following image.

  4. Click Save and Restart Server.

    This adds the attribute CSRF_TOKEN = 0 to the HTTP listener block of the server odin.cfg file.

If you are connecting from a Release 8.1.x or higher client, the CSRF Token should be enabled.


iWay Software