[SOLVED] Microsoft SCOM REST API throws exception saying 'required anti-forgery cookie is not present'

Microsoft SCOM REST API throws exception saying 'required anti-forgery cookie is not present'

I am trying to get some information from the Microsoft System Center Operations Manager (SCOM) server hosted within my org.

First, I authenticate using NTLM (username and password):

curl --location 'https://xxxx/OperationsManager/authenticate' \
--header 'Content-Type: application/json; charset=utf-8' \
--header 'Authorization: NTLM xxxx'
--data '"base64_encoded_data"'

This works fine (200 OK) and I receive the SCOMSessionId and SCOM-CSRF-TOKEN in the Set-Cookie response headers.

Next, when I trigger the following request:

curl --location 'https://xxxx/OperationsManager/data/state' \
--header 'Content-Type: application/json; charset=utf-8' \
--header 'Cookie: SCOM-CSRF-TOKEN=xxxx; SCOMSessionId=xxxx' \
--data '{
  "classId": "Microsoft.SystemCenter.Library!Microsoft.SystemCenter.HealthService",
  "criteria": "DisplayName LIKE '\''xxxx%'\''",
  "displayColumns": [
    "healthstate",
    "displayname"
  ]
}'

It throws an error saying:

{
  "errorMessage": "The required anti-forgery cookie \"__RequestVerificationToken_xxxx\" is not present.",
  "errorTrace": "   at System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken)\r\n   at System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext, String cookieToken, String formToken)\r\n   at Microsoft.EnterpriseManagement.OMDataService.Filters.ValidateAntiForgeryTokenAttribute.OnActionExecuting(HttpActionContext actionContext)\r\n   at System.Web.Http.Filters.ActionFilterAttribute.OnActionExecutingAsync(HttpActionContext actionContext, CancellationToken cancellationToken)\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Web.Http.Filters.ActionFilterAttribute.<ExecuteActionFilterAsyncCore>d__0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Web.Http.Filters.ActionFilterAttribute.<ExecuteActionFilterAsyncCore>d__0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Web.Http.Controllers.ExceptionFilterResult.<ExecuteAsync>d__0.MoveNext()"
}

I am not sure what is meant by the RequestVerificationToken. I tried to search for this (and other potential tokens) in the Network calls (from Chrome Developer Tools) to no avail. I have tried both Curl and Postman to trigger the API calls.

Does anyone know how to resolve this?

Solution

The issue was resolved after setting the SCOM-CSRF-TOKEN as the header key and the URL decoded data (as received under Set-Cookie) as the header value.

This most likely happened because of some faulty server config.