403 Errors Following Upgrade of Multiple @sap-cloud-sdk Packages from 4.6.0 to 4.7.0/4.8.0

[deeagabor]

Describe the Bug

After upgrading multiple @sap-cloud-sdk packages from 4.6.0 to 4.7.0/4.8.0, we started seeing intermittent 403 responses on outbound calls to SAP S/4 APIs.

Before the upgrade, the same flows were stable and worked consistently.
After the upgrade, 403 errors appear on random calls without a clear pattern (same destination).
When we reverted to the previous working version (in our case noted as 4.0.6), all calls worked again.

Technical context

• Runtime: Node.js service on SAP BTP Cloud Foundry
• Target APIs: SAP S/4
• Client style: generated OData clients in TypeScript
• Network path: SAP Cloud Connector
• Destination: maintained in SAP BTP Cockpit
• Destination authentication: BasicAuthentication

Packages upgraded

• @sap-cloud-sdk/connectivity
• @sap-cloud-sdk/odata-v2
• @sap-cloud-sdk/openapi
• @sap-cloud-sdk/resilience
• @sap-cloud-sdk/generator
• @sap-cloud-sdk/openapi-generator
• @sap-cloud-sdk/test-util

Steps to Reproduce

1. Use the same app code and same BasicAuthentication destination (via Cloud Connector).
2. Deploy with SAP Cloud SDK 4.6.0 and run repeated calls to one API endpoint.
3. Update only lockfile-resolved SDK versions to 4.7.x or 4.8.x, redeploy, run the same calls.
4. See intermittent 403 after upgrade.
5. Revert lockfile to 4.6.0, redeploy, issue disappears.

Expected Behavior

• No functional change in authorization behavior for the same destination and same request logic when upgrading from 4.6.0 to 4.7.0/4.8.0
• Calls should remain consistently successful as before.

Screenshots

Used Versions

Node.js: 24.5.0
npm: 11.5.1

Code Examples

No response

Log File

No response

Affected Development Phase

Release

Impact

Impaired

Timeline

No response

Additional Context

No response

[davidkna-sap]

Hey @deeagabor,

Thank you for opening this issue. We’ll investigate it.

In the meantime, one of the most significant changes introduced in SAP Cloud SDK v4.7.0 was the default use of keepAlive on sockets. Could you please check whether setting agentOptions.keepAlive to false on your Destination changes the behavior?

Also, are you testing all SAP Cloud SDK versions with the same axios version? We’ve recently seen some reports of possible regressions related to that as well.

[deeagabor]

Hi,

Thank you for the quick response!

I'm using the same Axios version (1.15.0) because all of the updated SAP Cloud SDK packages are part of the same service.

I also tried setting agentOptions.keepAlive to false, and it seems to resolve the failed calls, but only after updating the package to version 4.8.0. With version 4.7.0, the calls still fail with the same 403 error.

[davidkna-sap]

Hi,

Thank you for your prompt feedback as well. agentOptions.keepAlive was added in 4.8.0 and will not work with older versions.
We will investigate restricting sharing of sockets more strongly or disabling it by default in your scenario.

[deeagabor]

Hi,
All right, then we will change the code on our side to set agentOptions.keepAlive to false for all SAP calls. Thank you for your help!

[aldokkani]

Hi, we are having the same issue in Build Apps. Any timeline for releasing a fix?

[davidkna-sap]

Hey @deeagabor and @aldokkani,

SAP Cloud SDK v4.9.0 has now been released with additional remediations for this issue. Please share whether the new version resolves your issues.