2

Recently Jenkins has been putting out a number of security warnings related to CSRF Protection. We tried enabling it on our version of Jenkins (ver. 2.89.2) only to find that with it enabled you can no longer add or edit parameters on either freestyle or pipeline jobs via the GUI.

I did fairly extensive testing to narrow it down as the culprit, but I still don't understand why the option exists and is being recommended if it cripples Jenkins jobs.

Is this a feature or a bug? If it is a feature, why? What's to gain?

Improve this question

1 Answer 1

Reset to default
1

I believe this may be a result of running Jenkins behind a proxy, which can cause legitimate requests to perhaps appear to Jenkins as cross-site requests. From the official wiki:

If you are using nginx as a reverse proxy in front of Jenkins, you need an extra system property on Jenkins "-Dhudson.security.csrf.requestfield=Jenkins-Crumb". See JENKINS-23793 for more details

Improve this answer
1
  • I wish I could re-upvote this. Bit me on a new jenkins install three years later and I found my own question in my googling. Thank you once again!
    – Alex
    Commented Mar 17, 2021 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.