HTML5 Application 403 Forbidden error while calling Cloud Connector

[SG]

Hello, I have created an UI5 Fiori Application using BAS in BTP. When i do a prereview of the application i am getting the results correctly. The application is picking up Location Hierarchy and putting it in a tree structure. The location hierarchy is read from the On-Premises S4Hana system using Cloud connector and Destination defined in the BTP.  In the BAS when i run the CURL command and provide the URL. I am able to get the metadata.

Here is the preview of my application 

Now i deployed this application to BTP Cloud Foundry as an HTML5 Application and it was deployed successfully without any error from BAS

Now, when i try to run the application from HTML5 Application Tab/ Repository. I am not able to get the Location tree loaded. 

When i debug the calls in Google Chrome developer mode. I noticed there is an 403 Error.

In the Preview tab i see 

I spoke to my Network and BASIS Admin. They do not have the UCON enabled in the On-Premises system.

I am totally lost and would appreciate if anyone can help me resolve the issue. 

Here is how my xs-app.json file looks like

here is xs-security.json file looks like

Thanks for all your help and time in helping me resolve this issue.

[MarkusTolksdorf]

Hi, 

even if your admin claims that UCON is not turned on, the message is clearly a message from UCON. It is not allowing the request you made. The easiest approach is to check on backend side why this happens. 

Best regards,
Markus

[SG]

Hi Markus, Thanks for the reply.

1. Can u please direct or guide me on how to check the Status of UCON in the ON Premises System.

2. If the UCON is turned on. Then, how is it that i am able to run the CURL command from BAS and Application Preview successfully retrieves the data from the Backend On-Premises system using the Cloud Connector Destination. 

3. Do i need to add any values like roles , etc in the Xs-security.json and xs-app.json file ?

4.  In the header of the call the it says the 403 Forbidden error has a refence policy of strict-origin-when-cross-origin . Does that mean anything ..?

Thanks for your time and help .