A NOC developer automates SD-WAN Manager alarms retrieval, must authenticate programmatically, maintain session state across calls, and include forgery protection headers on writes. Which Manager REST API authentication sequence best satisfies this API monitoring requirement?
Select an answer to reveal the explanation.
Short Explanation
Automation needs both a hall pass and a matching stamp for safety. Session handling is like keeping your wristband on during a festival. The JSESSIONID plus XSRF pairing keeps reads and writes trusted.
Full Explanation
SD-WAN Manager REST uses stateful authentication where POSTing credentials establishes a JSESSIONID cookie that must be stored and resent to maintain session state, then fetching the client XSRF token and returning it as X-XSRF-TOKEN header with the cookie satisfies programmatic login and forgery protection for automated alarm retrieval and writes. Replaying the session cookie alone without fetching the token breaks forgery defense because SD-WAN Manager rejects state-changing calls lacking the expected header even with a valid session, a frequent failure when only GET polling was tested. Placing the token in the URL query string instead of the header breaks enforcement because validation compares the header to the session context and ignores query values, a pattern valid on some APIs but ineffective here and risky for log exposure. Using an OAuth bearer token for stateless polling fails because the session-based flow in this scenario relies on the JSESSIONID cookie plus the XSRF header rather than an Authorization header, and the stem requires maintained session state. For exams remember login must precede token fetch and both artifacts travel together, with the token mandatory for POST PUT DELETE while GETs still need the session. Practically verify with a cookie-aware client that login sets JSESSIONID, token fetch succeeds, and a lab write returns 403 if either artifact is missing or misplaced.