Error: HTTP 403 OPS$403 Forbidden on REST API Endpoints in OPS/MVS

Products

• OPS/MVS Event Management & Automation

Issue/Introduction

After installing security PTFs LU20788, LU20961, LU20363, or LU20992, OPSREST server calls return HTTP 403 errors. This occurs because Cross-Site Request Forgery (CSRF) protection is now enabled by default to address security vulnerabilities.

The error message received is: 'The user is not authorized to access the target resource.'

{
  "messages": [
    {
      "messageType": "ERROR",
      "messageNumber": "OPS$403",
      "messageContent": "The user is not authorized to access the target resource.",
      "messageReason": "The service has accepted the authentication of the user but the user does not have access rights to the resource.",
      "messageAction": "Contact your security administrator to obtain access.",
      "messageKey": "com.broadcom.security.rest.forbidden",
      "messageInstanceId": "######################################",
      "messageComponent": "com.broadcom.restapi.sdk.security.auth.SdkAccessDeniedHandler",
        }
  ]
}

Environment

OPS/MVS

Cause

Vulnerability fixes enable CSRF protection by default. The server now requires a valid X-XSRF-TOKEN header and an XSRF-TOKEN cookie for all state-changing requests.

Resolution

1: Include CSRF Tokens (Recommended)

1. Retrieve a token by sending a GET request to the /csrf endpoint: GET https://<hostname>:<port>/csrf
2. Include the returned token in all subsequent requests:
   • Header: X-XSRF-TOKEN: <token_value>
   • Cookie: XSRF-TOKEN=<token_value>

Method 2: Disable CSRF Protection

1. Open the application.yml file.
2. Locate or add the following parameter, ensuring it starts at column 3:
   yaml

    

     csrf.api.enabled: false

3. Restart the OPSREST server.