We have an API to retrieve an X-CSRF token into our SAP System using oData Provisioning.
Prior to the call, we retrieve an auth-token which works fine.
We use the token in the X-CSRF
Authorization: Bearer (Auth Token)
X-CSRF-Token: Fetch
The API always returns a 200 OK return.
The problem is, around 50% of the time the X-CSRF-Token is not included in the returned header