Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50767

Control initial crumb issuer proxy compatibility value

    • Icon: Improvement Improvement
    • Resolution: Fixed
    • Icon: Minor Minor
    • core
    • None

      The Jenkins Setup Wizard enables the CSRF protection.
      By default, this takes into account the client IP.

      In some setups involving reverse proxies, the client IP seen by Jenkins is not the real client IP, but the IP of the reverse proxy. Sometimes, it is due to incorrect reverse proxy configuration, but in some other cases, it is a limitation that cannot be overcome.

      Examples:

      • Azure Load Balancer is a Layer 4 load balancer (TCP). The IP Jenkins sees is the internal IP of the load balancer. Since it is pooled, this IP can change from request to request and cause crumb error.
      • AWS ELB using TCP listener (Layer 4): same problem.

      Note: on AWS, it is possible to use a HTTP listener and it will set the http header X-Forwarded-For containing the real client IP and Jenkins doesn't need proxy compatibility. For https deployment you have to terminate the SSL connection at the ELB level, which is not the case when using the Layer 4 Load balancer.

      This default setttings can then cause problems (invalid crumb errors) when using the default setup.

      The goal of this issue is to provide a way to enable or disable the initial state on startup using a system property.

      e.g. -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true will enable Proxy Compatibility on first startup.

          [JENKINS-50767] Control initial crumb issuer proxy compatibility value

          Daniel Beck added a comment -

          To clarify, Azure does not offer a load balancer that does not have this problem?

          Daniel Beck added a comment - To clarify, Azure does not offer a load balancer that does not have this problem?

          Indeed.

          Vincent Latombe added a comment - Indeed.

          Code changed in jenkins
          User: Vincent Latombe
          Path:
          core/src/main/java/jenkins/install/SetupWizard.java
          http://jenkins-ci.org/commit/jenkins/909f55b77da1d4a0a16a818fe592504538e49430
          Log:
          JENKINS-50767 Control crumb issuer proxy compatibility through system property (#3389)

          -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true enables proxy compatibility on startup

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Vincent Latombe Path: core/src/main/java/jenkins/install/SetupWizard.java http://jenkins-ci.org/commit/jenkins/909f55b77da1d4a0a16a818fe592504538e49430 Log: JENKINS-50767 Control crumb issuer proxy compatibility through system property (#3389) -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true enables proxy compatibility on startup

            vlatombe Vincent Latombe
            vlatombe Vincent Latombe
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: