# WebRTC Remote Access fails with 400 Bad Request — XSRF-TOKEN=undefined in request

**URL:** <https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688>\
**Category:** Forum\
**Tags:** thin-edge-io, device-management, cumulocity\
**Created:** [November 12, 2025, 9:04am UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688 "2025-11-12T09:04:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![benjamin.ruoff](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/benjamin.ruoff/32/12298_2.png) [@benjamin.ruoff](https://community.cumulocity.com/u/benjamin.ruoff)\
**Post date:** [November 12, 2025, 9:04am UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688/1 "2025-11-12T09:04:14Z")

</div>

Hi everyone,

I’m currently testing the **WebRTC Webcam Plugin** ( [GitHub - Cumulocity-IoT/cumulocity-webrtc-webcam-plugin: A plugin that allows to access the webcam of cumulocity devices via webrtc](https://github.com/Cumulocity-IoT/cumulocity-webrtc-webcam-plugin) ) in the Device Management app.

When I try to open a device webcam session, the WebSocket connection to the Remote Access service fails with a **400 Bad Request**.

Here’s the relevant request:

```auto
GET wss://our-tenant-url/service/remoteaccess/client/4711676997/configurations/1?token=Basic dXXXXXX...&XSRF-TOKEN=undefined
Status: 400 Bad Request

```

I noticed that the query parameter contains XSRF-TOKEN=undefined, and I’m wondering if that might be the reason.

It seems like the front-end (or plugin) is appending the XSRF token automatically, but the value is not set — literally “undefined”.

My questions:

- Is this caused by a **misconfiguration on my tenant or device setup** , or

- Is this a **bug in the Remote Access plugin / WebRTC integration** that incorrectly appends the token?

Additional info:

- Browser: Firefox 144.0 on macOS

- The ICE/STUN phase completes successfully — this only happens at the WebSocket connect stage.

Any insights would be greatly appreciated!

Thanks in advance.  
Benjamin

---

<div class="post-metadata">

**Author:** ![Tristan\_Bastian](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/tristan_bastian/32/18259_2.png) [@Tristan\_Bastian](https://community.cumulocity.com/u/Tristan_Bastian)\
**Post date:** [November 12, 2025, 9:34am UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688/2 "2025-11-12T09:34:04Z")

</div>

Hi @benjamin.ruoff,

This might be an issue with the WebRTC plugin.. As a workaround could you give it a try by configuring your tenant for OAuth (OAI-Secure) instead of Basic auth? [Basic settings - Cumulocity documentation](https://cumulocity.com/docs/authentication/basic-settings/)

Regards,  
Tristan

---

<div class="post-metadata">

**Author:** ![Tristan\_Bastian](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/tristan_bastian/32/18259_2.png) [@Tristan\_Bastian](https://community.cumulocity.com/u/Tristan_Bastian)\
**Post date:** [November 12, 2025, 10:01am UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688/3 "2025-11-12T10:01:26Z")

</div>

I’ve also added a fix that should be available soon in version 3.0.1 of the plugin.

Would be great if you could provide some feedback if it works for you now with basic auth.

---

<div class="post-metadata">

**Author:** ![benjamin.ruoff](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/benjamin.ruoff/32/12298_2.png) [@benjamin.ruoff](https://community.cumulocity.com/u/benjamin.ruoff)\
**Post date:** [November 12, 2025, 10:18am UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688/4 "2025-11-12T10:18:04Z")

</div>

Hi Tristan,

yep you were right, it’s because of the basic auth. I just switched to OAuth (OAI-Secure) an now it works like a charm.

As soon as your fix is available I will test it again, with basic auth.

Thank for your fast feedback.

---

<div class="post-metadata">

**Author:** ![benjamin.ruoff](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/benjamin.ruoff/32/12298_2.png) [@benjamin.ruoff](https://community.cumulocity.com/u/benjamin.ruoff)\
**Post date:** [December 3, 2025, 1:30pm UTC](https://community.cumulocity.com/t/webrtc-remote-access-fails-with-400-bad-request-xsrf-token-undefined-in-request/13688/5 "2025-12-03T13:30:06Z")

</div>

Hi Tristan,

just to let you know, we tested the fix and it works like a charm