Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-15252

Why is "Prevent Cross Site Request Forgery exploits" disabled by default?

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • core

      1. It's not clear why "Prevent Cross Site Request Forgery exploits" is disabled by default.
      2. The help needs to explain the downside of enabling this feature, if any.

          [JENKINS-15252] Why is "Prevent Cross Site Request Forgery exploits" disabled by default?

          Daniel Beck added a comment - - edited

          Would this be sufficient?

          Some Jenkins features (like the REST API) are more difficult to use when this
          option is enabled. Some features, especially in plugins not tested with this
          option enabled, may not work at all. Some reverse proxies may filter the "crumb"
          parameter, resulting in failures when trying to use certain actions.

          Daniel Beck added a comment - - edited Would this be sufficient? Some Jenkins features (like the REST API) are more difficult to use when this option is enabled. Some features, especially in plugins not tested with this option enabled, may not work at all. Some reverse proxies may filter the "crumb" parameter, resulting in failures when trying to use certain actions.

          cowwoc added a comment -

          That sounds okay to me.

          cowwoc added a comment - That sounds okay to me.

          Code changed in jenkins
          User: Daniel Beck
          Path:
          core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html
          http://jenkins-ci.org/commit/jenkins/16509dc22c7129f64c6c2668779b71de819912cf
          Log:
          [FIXED JENKINS-15252] Explain problems with CSRF protection

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Beck Path: core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html http://jenkins-ci.org/commit/jenkins/16509dc22c7129f64c6c2668779b71de819912cf Log: [FIXED JENKINS-15252] Explain problems with CSRF protection

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html
          http://jenkins-ci.org/commit/jenkins/8e0b87c0ace41478dce790eceb18019d32371242
          Log:
          Merge pull request #1438 from daniel-beck/JENKINS-15252

          [FIXED JENKINS-15252] Explain problems with CSRF protection

          Compare: https://github.com/jenkinsci/jenkins/compare/6ee4d4a92757...8e0b87c0ace4

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html http://jenkins-ci.org/commit/jenkins/8e0b87c0ace41478dce790eceb18019d32371242 Log: Merge pull request #1438 from daniel-beck/ JENKINS-15252 [FIXED JENKINS-15252] Explain problems with CSRF protection Compare: https://github.com/jenkinsci/jenkins/compare/6ee4d4a92757...8e0b87c0ace4

          dogfood added a comment -

          Integrated in jenkins_main_trunk #3779
          [FIXED JENKINS-15252] Explain problems with CSRF protection (Revision 16509dc22c7129f64c6c2668779b71de819912cf)

          Result = SUCCESS
          daniel-beck : 16509dc22c7129f64c6c2668779b71de819912cf
          Files :

          • core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html

          dogfood added a comment - Integrated in jenkins_main_trunk #3779 [FIXED JENKINS-15252] Explain problems with CSRF protection (Revision 16509dc22c7129f64c6c2668779b71de819912cf) Result = SUCCESS daniel-beck : 16509dc22c7129f64c6c2668779b71de819912cf Files : core/src/main/resources/hudson/security/csrf/GlobalCrumbIssuerConfiguration/help-csrf.html

            danielbeck Daniel Beck
            cowwoc cowwoc
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: