topic Re: ISE 3.1 API nonce validation failed in Network Access Control

ISE 3.1 API nonce validation failed

Ralf Fischer — Tue, 20 Jun 2023 14:15:36 GMT

Hi all,

I want to add new Endpoints via API. I'm using this endpoint:

POST /ers/config/endpoint

The system needs a X-CSRF-TOKEN header. I get this Token before sending the POST Request via GET /ers/config/endpoint with the following headers:

'Accept': 'application/json',

'Content-Type': 'application/json',

'X-CSRF-TOKEN': 'fetch'

I get a proper Token within the response. If I use this token for my POST request i get a 403 forbidden response with the following response body:

CSRF nonce validation failed

Thank you for your help in advance!

Best,

Ralf

Re: ISE 3.1 API nonce validation failed

Charlie Moreton — Tue, 20 Jun 2023 14:52:51 GMT

How are you sending the request? Postman, CURL, etc.?
What do you mean you are sending a POST via GET? Those are two different requests.

To use `curl` you would send
curl --include --insecure --location \
--header 'Content-Type:application/json' \
--header 'Accept: application/json' \
--user $ise_username:$ise_password \
--request POST https://$ise_address/ers/config/endpoint \
--data '
{
  "ERSEndPoint" : {
    "name" : "MyEndpoint",
    "description" : "MyEndpoint",
    "mac" : "11:22:33:44:55:66",
    "groupId" : "aa13bb40-8bff-11e6-996c-525400b48521",
    "staticGroupAssignment" : true
  }
}

Visit https://cs.co/ise-api for more information

Re: ISE 3.1 API nonce validation failed

Ralf Fischer — Tue, 20 Jun 2023 15:05:16 GMT

Hi Charlie,

I'm using postman for my first draft, it is planned to use Azure LogicApps for production.

I send two requests (POSTMAN Pre-Request Script:)

pm.sendRequest({ url: "https://ISE-URL/ers/config/endpoint", method: 'GET', header: { 'Accept': 'application/json', 'Content-Type': 'application/json', 'X-CSRF-TOKEN': 'fetch' } }, function (err, response) { var responseHeaderXCSRFTOKEN = response.headers.get('X-CSRF-TOKEN'); pm.environment.set("ISE-X-CSRF-TOKEN", responseHeaderXCSRFTOKEN ); } );

than i use the Token within my POST request:

POST https://ISE-URL/ers/config/endpoint

with this header:

X-CSRF-TOKEN = {{ISE-X-CSRF-TOKEN}}

And i get this response:

code 403

CSRF nonce validation failed

Re: ISE 3.1 API nonce validation failed

poongarg — Wed, 21 Jun 2023 03:58:59 GMT

Can you please confirm if in the POST request, you are passing the session cookie along with token to tie the sessions together.

Re: ISE 3.1 API nonce validation failed

Ralf Fischer — Wed, 21 Jun 2023 06:24:12 GMT

Yes I can confirm that i pass two cookies along with my token:

APPSESSIONID=6E19EB596609FC58E304064CFF5C4AA3; JSESSIONIDSSO=B7BF6BC8BD33A0C8E6F331445B01EAB8

Re: ISE 3.1 API nonce validation failed

hslai — Sat, 24 Jun 2023 03:21:54 GMT

@Ralf Fischer See this old post Solved: Re: X-CSRF-TOKEN handling - Cisco Community