Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-12875

"No valid crumb was included in the request" errors all around

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Critical Critical
    • core
    • CentOS release 5.5 (Final) 64b

      After upgrading Jenkins from 1.448 to 1.451 (with yum, upgraded plugins too) several parts of Jenkins have become unusable with error "No valid crumb was included in the request":

      Console output

      • When building, the log is unavailable, see console_log.png
      • Once the build is done, the complete log is available, but the same error appears on the side console_side.png

      Build configuration

      • Builds cannot be launched anymore from the build page (The firebug error console displays the "No valid crumb was included in the request" error). They still can be launched from the dashboard though.
      • Cannot add build steps (when choosing a build step type an error is reported in background), see add_build_step.png

      Manage Jenkins configuration

      • The page loads only partially (first half is permanently greyed out, see configuration.png). The firebug error console displays the "No valid crumb was included in the request" error.

      Manage Jenkins plugins

      • Cannot upgrade nor downgrade, see error shown plugins.png

        1. add_build_step.png
          add_build_step.png
          98 kB
        2. configuration.png
          configuration.png
          85 kB
        3. console_log.png
          console_log.png
          105 kB
        4. console_side.png
          console_side.png
          202 kB
        5. plugins.png
          plugins.png
          92 kB
        6. Screen Shot 2014-03-12 at 10.43.58 AM.png
          Screen Shot 2014-03-12 at 10.43.58 AM.png
          111 kB

          [JENKINS-12875] "No valid crumb was included in the request" errors all around

          J Knurek added a comment -

          My first thought was that it was a bug specific to the Build Monitor View plugin, but when I run Jenkins 1.651.1, the same configuration works ok. I'm only getting this error with the 2.0-rc-1.
          (but I'm not sure what the underlying issue is in this case, so it is likely a separate issue)

          J Knurek added a comment - My first thought was that it was a bug specific to the Build Monitor View plugin, but when I run Jenkins 1.651.1, the same configuration works ok. I'm only getting this error with the 2.0-rc-1. (but I'm not sure what the underlying issue is in this case, so it is likely a separate issue)

          Jan Molak added a comment -

          danielbeck Build Monitor has supported CSRF protection since its early days

          The problem is caused by change https://github.com/jenkinsci/jenkins/compare/4649e04cbe58...a87c38c5052c , which replaced the hard-coded '.crumb' header with 'Jenkins-Crumb', that's why they no longer match.

          I can work around that in Build Monitor.

          jknurek you can watch the progress of this issue on github at https://github.com/jan-molak/jenkins-build-monitor-plugin/issues/215, which is the official issue tracker for Build Monitor.

          Thanks!
          Jan

          Jan Molak added a comment - danielbeck Build Monitor has supported CSRF protection since its early days The problem is caused by change https://github.com/jenkinsci/jenkins/compare/4649e04cbe58...a87c38c5052c , which replaced the hard-coded '.crumb' header with 'Jenkins-Crumb', that's why they no longer match. I can work around that in Build Monitor. jknurek you can watch the progress of this issue on github at https://github.com/jan-molak/jenkins-build-monitor-plugin/issues/215 , which is the official issue tracker for Build Monitor. Thanks! Jan

          Daniel Beck added a comment -

          janek

          which replaced the hard-coded '.crumb' header with 'Jenkins-Crumb', that's why they no longer match.

          The crumb name has been configurable since 1.310 (hudson.security.csrf.requestfield), and that was necessary for anyone running Jenkins behind nginx, as it dropped the .crumb header (JENKINS-12875). So we renamed the default to something nginx accepts. Maybe it's a good idea to check which crumb name is used by Jenkins in your plugin to adapt to user configuration.

          Daniel Beck added a comment - janek which replaced the hard-coded '.crumb' header with 'Jenkins-Crumb', that's why they no longer match. The crumb name has been configurable since 1.310 ( hudson.security.csrf.requestfield ), and that was necessary for anyone running Jenkins behind nginx, as it dropped the .crumb header ( JENKINS-12875 ). So we renamed the default to something nginx accepts. Maybe it's a good idea to check which crumb name is used by Jenkins in your plugin to adapt to user configuration.

          Jan Molak added a comment - - edited

          jknurek - Fixed in Build Monitor 1.9+build.2016043001​28, which you can download here before it hits the official update centre.

          Jan Molak added a comment - - edited jknurek - Fixed in Build Monitor 1.9+build.2016043001​28, which you can download here before it hits the official update centre.

          Jan Molak added a comment - - edited

          Awesome, thanks danielbeck, that's exactly what I did. The latest Build Monitor picks up the crumb name from CrumbIssuer::getCrumbRequestField so it should be a more appropriate solution

          Jan Molak added a comment - - edited Awesome, thanks danielbeck , that's exactly what I did. The latest Build Monitor picks up the crumb name from CrumbIssuer::getCrumbRequestField so it should be a more appropriate solution

          Naveen Sharma added a comment - - edited

          Hi,
          I have Jenkins 2.7, I have created the service hook in TFS to trigger the automatic build but while testing the hook I get " No valid crumb was included in the request (403)". I can run the same build from Jenkins dashboard with no issue.
          I have also installed the downgrade Build - Plugin-Version: 1.9+build.201606171408 as suggested by Jan Molak above but I am still facing the issue.

          P.s - I have installed Jenkins on my local windows 2007 machine.

          Thanks,

          Naveen Sharma added a comment - - edited Hi, I have Jenkins 2.7, I have created the service hook in TFS to trigger the automatic build but while testing the hook I get " No valid crumb was included in the request (403)". I can run the same build from Jenkins dashboard with no issue. I have also installed the downgrade Build - Plugin-Version: 1.9+build.201606171408 as suggested by Jan Molak above but I am still facing the issue. P.s - I have installed Jenkins on my local windows 2007 machine. Thanks,

          Jan Molak added a comment -

          Hey Naveen - from what you're saying it seems like the problem is related to Jenkins and not the Build Monitor plugin?
          If you think it's related to Build Monitor please feel free to raise a ticket on github at https://github.com/jan-molak/jenkins-build-monitor-plugin

          Thanks,
          Jan

          Jan Molak added a comment - Hey Naveen - from what you're saying it seems like the problem is related to Jenkins and not the Build Monitor plugin? If you think it's related to Build Monitor please feel free to raise a ticket on github at https://github.com/jan-molak/jenkins-build-monitor-plugin Thanks, Jan

          Naveen Sharma added a comment -

          Hi Jan, yeah I think the issue is either with Jenkins or may be with Tfs-jenkins plugin, I am not sure. Pls suggest.

          Thanks

          Naveen Sharma added a comment - Hi Jan, yeah I think the issue is either with Jenkins or may be with Tfs-jenkins plugin, I am not sure. Pls suggest. Thanks

          Ryan Cocks added a comment -

          Having just wasted a few hours debugging why I was seeing this: if you re-install Jenkins you need to clear your cookies or you'll hit this.

          Ryan Cocks added a comment - Having just wasted a few hours debugging why I was seeing this: if you re-install Jenkins you need to clear your cookies or you'll hit this.

          Daniel Beck added a comment -

          12niner Too many cookies is tracked as JENKINS-25046.

          Daniel Beck added a comment - 12niner Too many cookies is tracked as JENKINS-25046 .

            danielbeck Daniel Beck
            naloy Núria Aloy
            Votes:
            20 Vote for this issue
            Watchers:
            43 Start watching this issue

              Created:
              Updated:
              Resolved: