A Python script must read the device inventory from SD-WAN Manager and then push a device template change to the branch routers. The controller uses a local user login rather than SSO, and every call goes through one requests.Session object. Which authentication sequence gives the script a working session for both calls?
Select an answer to reveal the explanation.
Short Explanation
Log in at /j_security_check, then keep the JSESSIONID cookie and send the client token in X-XSRF-TOKEN on requests. It’s like keeping your entry badge and showing a second check before making changes: JSESSIONID keeps your session active, while the token protects writes.
Full Explanation
SD-WAN Manager (formerly vManage) authenticates with a session rather than an Authorization header: form-encoded credentials posted to /j_security_check set the JSESSIONID cookie, and a follow-up GET on the client token resource returns the anti-CSRF value to send in the X-XSRF-TOKEN header. Keeping both the cookie and the token allows the script to make inventory reads and template writes. State-changing calls can be rejected when the XSRF token is missing; the token is associated with the server-side session, so sending it without the cookie is insufficient. Putting credentials in an Authorization header does not establish the session required by this login flow. The token requirement depends on the controller release; early releases and study material may show cookie-only authentication. A practical check is to remove the token header and test whether the template write is rejected while the inventory read still works.