Token working in Postman but not in web application

[NileshValwaikar]

Hello,

I am trying to export a shapefile for a featurelayer which has export enabled. everything is working manually and also from postman, but when i am trying to integrate the same in my javascript web application its giving code 498 Invalid Token. This token is generated fresh having referrer ="*" and expiry of 15days. as said its working in postman but not in my simple HTML code also.

below is a sample snippet of my code...

const formdata = new FormData();
formdata.append("itemId", "33cfb3f2849e4793b6551512e0eddac8");
formdata.append("exportFormat", "Shapefile");
formdata.append("token", "MyTOKEN");
formdata.append("exportParameters", "{\n \"layers\" :[ {\"id\" : 0,\"where\" : \"ward_name = 'Bagahada'\"}]\n}");
formdata.append("f", "json");
formdata.append("title", "testshp4");

const requestOptions = {
method: "POST",
body: formdata,
redirect: "follow"
};

fetch("https://myportal/portal/sharing/rest/content/users/portaladmin/export", requestOptions)
.then((response) => response.text())
.then((result) => console.log(result))
.catch((error) => console.error(error));

[Sage_Wall]

Hi @NileshValwaikar , Try removing the referrer configuration or adding the protocol and domain.  The * is only allowed as a subdomain (https://*.your-app.com). If you want to allow it to be used from everywhere just leave the referrer empty.  I believe that it's probably working in Postman because postman likely doesn't send a referrer by default.

[nafizpervez]

When using FormData, you don't need to manually set the Content-Type header, as it will be automatically set by the browser. However, if you manually set the Content-Type to something like application/x-www-form-url encoded or multipart/form-data, it might conflict with the request.

Remove any manual Content-Type header if it's set in your fetch request.

const formdata = new FormData();
formdata.append("itemId", "33cfb3f2849e4793b6551512e0eddac8");
formdata.append("exportFormat", "Shapefile");
formdata.append("token", "MyTOKEN");
formdata.append("exportParameters", "{\n \"layers\" :[ {\"id\" : 0,\"where\" : \"ward_name = 'Bagahada'\"}]\n}");
formdata.append("f", "json");
formdata.append("title", "testshp4");

const requestOptions = {
  method: "POST",
  body: formdata,
  headers: {
    "Referer": "https://your-web-app.com",  // Adjust with your web app URL if necessary
  },
  redirect: "follow"
};

fetch("https://myportal/portal/sharing/rest/content/users/portaladmin/export", requestOptions)
  .then(response => {
    // Check if the response is ok
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    return response.text();
  })
  .then(result => {
    console.log("Export result: ", result);
  })
  .catch(error => {
    console.error("Fetch error: ", error);
  });