403 Errors Following Upgrade of Multiple @sap-cloud-sdk Packages from 4.6.0 to 4.7.0/4.8.0
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 219
- Forks
- 74
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 60
Description
Describe the Bug
After upgrading multiple @sap-cloud-sdk packages from 4.6.0 to 4.7.0/4.8.0, we started seeing intermittent 403 responses on outbound calls to SAP S/4 APIs.
Before the upgrade, the same flows were stable and worked consistently.
After the upgrade, 403 errors appear on random calls without a clear pattern (same destination).
When we reverted to the previous working version (in our case noted as 4.0.6), all calls worked again.
Technical context
- Runtime: Node.js service on SAP BTP Cloud Foundry
- Target APIs: SAP S/4
- Client style: generated OData clients in TypeScript
- Network path: SAP Cloud Connector
- Destination: maintained in SAP BTP Cockpit
- Destination authentication: BasicAuthentication
Packages upgraded
- @sap-cloud-sdk/connectivity
- @sap-cloud-sdk/odata-v2
- @sap-cloud-sdk/openapi
- @sap-cloud-sdk/resilience
- @sap-cloud-sdk/generator
- @sap-cloud-sdk/openapi-generator
- @sap-cloud-sdk/test-util
Steps to Reproduce
- Use the same app code and same BasicAuthentication destination (via Cloud Connector).
- Deploy with SAP Cloud SDK 4.6.0 and run repeated calls to one API endpoint.
- Update only lockfile-resolved SDK versions to 4.7.x or 4.8.x, redeploy, run the same calls.
- See intermittent 403 after upgrade.
- Revert lockfile to 4.6.0, redeploy, issue disappears.
Expected Behavior
- No functional change in authorization behavior for the same destination and same request logic when upgrading from 4.6.0 to 4.7.0/4.8.0
- Calls should remain consistently successful as before.
Screenshots
Used Versions
Node.js: 24.5.0
npm: 11.5.1
Code Examples
No response
Log File
No response
Affected Development Phase
Release
Impact
Impaired
Timeline
No response
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with @sap-cloud-sdk/connectivity and @sap-cloud-sdk/resilience, comparing resolved 4.6.0 and 4.7.x/4.8.x behavior for repeated generated OData client calls through a BasicAuthentication destination and Cloud Connector. Reproduce the intermittent 403 using the listed Node.js and TypeScript setup; done means identifying a version-specific regression or explaining why calls remain consistently successful after the upgrade.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100